Clear-text Logging of Sensitive Information in luigi/contrib/pai.py

[Ali-Razmjoo]

Hi,

I am reporting a potential security issue has been identified in the file luigi/contrib/pai.py.

luigi/luigi/contrib/pai.py

Lines 240 to 242 in 9e0898e

	request_json = json.dumps({'username': self.__openpai.username, 'password': self.__openpai.password,
	'expiration': self.__openpai.expiration})
	logger.debug('Get token request {0}'.format(request_json))

The code snippet logs sensitive information, specifically the username and password, in clear text. This can expose sensitive data if the logs are accessed by unauthorized parties.

Sensitive information like passwords should not be logged. Instead, consider logging non-sensitive parts of the request or obfuscating sensitive data before logging.

Thanks.

References

• OWASP Top 10: A09:2021 – Security Logging and Monitoring Failures
• CWE-312: Cleartext Storage of Sensitive Information
• CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
• CWE-532: Insertion of Sensitive Information into Log File