From c878e341fcf8b84cbac89976da8e9033f657b6fc Mon Sep 17 00:00:00 2001 From: John Lee Date: Mon, 25 May 2026 10:15:04 +0800 Subject: [PATCH] Potential fix for code scanning alert no. 21: Clear-text logging of sensitive information Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- teaagent/cli/_handlers/_doctor.py | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/teaagent/cli/_handlers/_doctor.py b/teaagent/cli/_handlers/_doctor.py index ff33b5ab..44be3925 100644 --- a/teaagent/cli/_handlers/_doctor.py +++ b/teaagent/cli/_handlers/_doctor.py @@ -43,18 +43,29 @@ def _is_sensitive_key(key: str) -> bool: return any(marker in normalized for marker in _SENSITIVE_KEY_MARKERS) -def _redact_sensitive_fields(value: Any) -> Any: +def _redact_sensitive_fields( + value: Any, known_sensitive_values: set[str] | None = None +) -> Any: + if known_sensitive_values is None: + known_sensitive_values = set() + if isinstance(value, dict): redacted: dict[Any, Any] = {} for k, v in value.items(): key_str = str(k) if _is_sensitive_key(key_str): + if isinstance(v, str) and v: + known_sensitive_values.add(v) redacted[k] = _REDACTED else: - redacted[k] = _redact_sensitive_fields(v) + redacted[k] = _redact_sensitive_fields(v, known_sensitive_values) return redacted if isinstance(value, list): - return [_redact_sensitive_fields(item) for item in value] + return [ + _redact_sensitive_fields(item, known_sensitive_values) for item in value + ] + if isinstance(value, str) and value in known_sensitive_values: + return _REDACTED return value