CI #64
CI #64
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| logger.exception("Error occurred during Twilio call for phone number %s: %s", phone_number, str(e)) | ||
| logger.exception( | ||
| "Error occurred during Twilio call for phone number %s: %s", | ||
| phone_number, |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 2 months ago
To fix the problem, we should avoid logging the phone number directly. Instead, we can log a masked version of the phone number or omit it entirely from the log message. This way, we still get useful logging information without exposing sensitive data.
The best way to fix this without changing existing functionality is to mask the phone number before logging it. We can replace the middle digits of the phone number with asterisks or another character to ensure that the sensitive part of the data is not exposed.
We need to modify the logging statement on lines 16-18 to mask the phone number. Additionally, we need to add a helper function to perform the masking.
| @@ -8,2 +8,5 @@ | ||
|
|
||
| def mask_phone_number(phone_number): | ||
| return phone_number[:2] + "****" + phone_number[-2:] | ||
|
|
||
| def lookup_telecom_provider(phone_number): | ||
| @@ -14,5 +17,6 @@ | ||
| except Exception as e: | ||
| masked_phone_number = mask_phone_number(phone_number) | ||
| logger.exception( | ||
| "Error occurred during Twilio call for phone number %s: %s", | ||
| phone_number, | ||
| masked_phone_number, | ||
| str(e), |
No description provided.