fix(logging): Improve the sanitization of credentials in local debug logs

danlucian · danlucian · commit 38322f377da7 · 2025-06-23T16:09:52.000+03:00
diff --git a/binary-releases/RELEASE_NOTES.md b/binary-releases/RELEASE_NOTES.md
@@ -1,10 +1,7 @@
-## [1.1297.2](https://github.com/snyk/snyk/compare/v1.1297.1...1.1297.2) (2025-06-16)
+## [1.1297.3](https://github.com/snyk/snyk/compare/v1.1297.2...1.1297.3) (2025-06-23)
 
 The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see [this documentation](https://docs.snyk.io/snyk-cli/releases-and-channels-for-the-snyk-cli)
 
 ### Bug Fixes
 
-* **logging:** Improves the sanitization of credentials in local debug logs. ([e054455](https://github.com/snyk/snyk/commit/e054455eab8e686f19c165a8bad86259103a5f5d))
-* **language-server:** IDE Connectivity for Proxy Users: Fixes an issue where IDE plugins could fail to connect when operating behind an NTLM proxy.
-* **language-server:** Snyk Code Local Engine Fix: Addresses a regression that prevented the Snyk Code Local Engine (SCLE) from functioning correctly within the IDEs.
-
+* **logging:** Improves the sanitization of credentials in local debug logs. ([e50fb22](https://github.com/snyk/snyk/commit/e50fb22cde76b3ca01e6a21d5495534c06586df9))
diff --git a/cliv2/go.mod b/cliv2/go.mod
@@ -16,7 +16,7 @@ require (
 	github.com/snyk/cli-extension-sbom v0.0.0-20250422133603-a5ae6fdf0934
 	github.com/snyk/container-cli v0.0.0-20250321132345-1e2e01681dd7
 	github.com/snyk/error-catalog-golang-public v0.0.0-20250429130542-564b0605020e
-	github.com/snyk/go-application-framework v0.0.0-20250612130357-31093e6eb8ad
+	github.com/snyk/go-application-framework v0.0.0-20250623124518-ca7ba7d72e68
 	github.com/snyk/go-httpauth v0.0.0-20240307114523-1f5ea3f55c65
 	github.com/snyk/snyk-iac-capture v0.6.5
 	github.com/snyk/snyk-ls v0.0.0-20250613113919-2b232b9d448d
diff --git a/cliv2/go.sum b/cliv2/go.sum
@@ -808,8 +808,8 @@ github.com/snyk/container-cli v0.0.0-20250321132345-1e2e01681dd7 h1:/2+2piwQtB9f
 github.com/snyk/container-cli v0.0.0-20250321132345-1e2e01681dd7/go.mod h1:38w+dcAQp9eG3P5t2eNS9eG0reut10AeJjLv5lJ5lpM=
 github.com/snyk/error-catalog-golang-public v0.0.0-20250429130542-564b0605020e h1:XFGkHDWA8JTPLr82QzoKVqGytofEYBf68VqoUq8yvXk=
 github.com/snyk/error-catalog-golang-public v0.0.0-20250429130542-564b0605020e/go.mod h1:Ytttq7Pw4vOCu9NtRQaOeDU2dhBYUyNBe6kX4+nIIQ4=
-github.com/snyk/go-application-framework v0.0.0-20250612130357-31093e6eb8ad h1:RpUp1oayxILiWL6jGnXgAYiz7E44minwFEeDXJU3Xc0=
-github.com/snyk/go-application-framework v0.0.0-20250612130357-31093e6eb8ad/go.mod h1:Hy8dugDhTPRPe99Bf4mG7zeh7+OobdWfX5dzhbeQQsU=
+github.com/snyk/go-application-framework v0.0.0-20250623124518-ca7ba7d72e68 h1:eTR15PecAEX3F9HvptgPWI1Z936qirRoIGCiK3kALfU=
+github.com/snyk/go-application-framework v0.0.0-20250623124518-ca7ba7d72e68/go.mod h1:Hy8dugDhTPRPe99Bf4mG7zeh7+OobdWfX5dzhbeQQsU=
 github.com/snyk/go-httpauth v0.0.0-20240307114523-1f5ea3f55c65 h1:CEQuYv0Go6MEyRCD3YjLYM2u3Oxkx8GpCpFBd4rUTUk=
 github.com/snyk/go-httpauth v0.0.0-20240307114523-1f5ea3f55c65/go.mod h1:88KbbvGYlmLgee4OcQ19yr0bNpXpOr2kciOthaSzCAg=
 github.com/snyk/policy-engine v0.33.2 h1:ZxD6/RQ4vqUAXa64V72SsGjZ8vmnBgZNGYQxMIqctYo=
diff --git a/cliv2/internal/cliv2/cliv2.go b/cliv2/internal/cliv2/cliv2.go
@@ -427,7 +427,7 @@ func (c *CLI) executeV1Default(proxyInfo *proxy.ProxyInfo, passThroughArgs []str
 		c.DebugLogger.Println("Launching: ")
 		c.DebugLogger.Println("  ", c.v1BinaryLocation)
 		c.DebugLogger.Println(" With Arguments:")
-		c.DebugLogger.Println("  ", strings.Join(passThroughArgs, ", "))
+		c.DebugLogger.Println(" ", strings.Join(passThroughArgs, " "))
 		c.DebugLogger.Println(" With Environment: ")
 
 		variablesMap := utils.ToKeyValueMap(snykCmd.Env, "=")
diff --git a/cliv2/pkg/basic_workflows/legacycli.go b/cliv2/pkg/basic_workflows/legacycli.go
@@ -84,7 +84,6 @@ func legacycliWorkflow(
 	proxyAuthenticationMechanism := httpauth.AuthenticationMechanismFromString(proxyAuthenticationMechanismString)
 	analyticsDisabled := config.GetBool(configuration.ANALYTICS_DISABLED)
 
-	debugLogger.Print("Arguments:", args)
 	debugLogger.Print("Use StdIO:", useStdIo)
 	debugLogger.Print("Working directory:", workingDirectory)
 
diff --git a/src/cli/args.ts b/src/cli/args.ts
@@ -8,7 +8,6 @@ import {
   SupportedUserReachableFacingCliArgs,
 } from '../lib/types';
 import { getContainerImageSavePath } from '../lib/container';
-import { obfuscateArgs } from '../lib/utils';
 
 export declare interface Global extends NodeJS.Global {
   ignoreUnknownCA: boolean;
@@ -119,8 +118,6 @@ export function args(rawArgv: string[]): Args {
     debugModule.enable(enable);
   }
 
-  const debug = debugModule('snyk');
-
   // Late require, see the note re "debug" option above.
   const cli = require('./commands');
 
@@ -273,8 +270,6 @@ export function args(rawArgv: string[]): Args {
     global.ignoreUnknownCA = true;
   }
 
-  debug(command, obfuscateArgs(argv));
-
   return {
     command,
     method,
diff --git a/test/jest/acceptance/debuglog.spec.ts b/test/jest/acceptance/debuglog.spec.ts
@@ -4,7 +4,7 @@ import {
   createProjectFromWorkspace,
 } from '../util/createProject';
 
-jest.setTimeout(1000 * 60);
+jest.setTimeout(10000 * 60);
 
 describe('debug log', () => {
   it('redacts token from env var', async () => {
@@ -48,7 +48,85 @@ describe('debug log', () => {
 
   it('redacts basic authentication', async () => {
     const { stderr } = await runSnykCLI(
-      'container test ubuntu:latest --username=us --password=pw -d',
+      'container test ubuntu:latest --username=john.doe@domain.org --password=solidpassword -d',
+      {
+        env: {
+          ...process.env,
+          SNYK_DISABLE_ANALYTICS: '1',
+        },
+      },
+    );
+
+    expect(stderr).not.toContain('Basic am9ob');
+    expect(stderr).toContain('Basic ***');
+
+    expect(stderr).not.toContain('john.doe@domain.org');
+    expect(stderr).not.toContain('solidpassword');
+  });
+
+  it('redacts short-form basic authentication', async () => {
+    const { stderr } = await runSnykCLI(
+      'container test ubuntu:latest -u=john.doe@domain.org -p=solidpassword -d',
+      {
+        env: {
+          ...process.env,
+          SNYK_DISABLE_ANALYTICS: '1',
+        },
+      },
+    );
+
+    expect(stderr).not.toContain('Basic am9ob');
+    expect(stderr).toContain('Basic ***');
+
+    expect(stderr).not.toContain('john.doe@domain.org');
+    expect(stderr).not.toContain('solidpassword');
+
+    expect(stderr).toContain('-u=***');
+    expect(stderr).toContain('-p=***');
+  });
+
+  it('redacts ENV-driven basic authentication', async () => {
+    const { stderr } = await runSnykCLI('container test ubuntu:latest -d', {
+      env: {
+        ...process.env,
+        SNYK_DISABLE_ANALYTICS: '1',
+        SNYK_REGISTRY_USERNAME: 'john.doe@domain.org',
+        SNYK_REGISTRY_PASSWORD: 'solidpassword',
+      },
+    });
+
+    expect(stderr).not.toContain('Basic am9ob');
+    expect(stderr).toContain('Basic ***');
+
+    expect(stderr).not.toContain('john.doe@domain.org');
+    expect(stderr).not.toContain('solidpassword');
+  });
+
+  it('redacts basic authentication with trace log level', async () => {
+    const { stderr } = await runSnykCLI(
+      'container test ubuntu:latest --username=john.doe@domain.org --password=solidpassword -d',
+      {
+        env: {
+          ...process.env,
+          SNYK_DISABLE_ANALYTICS: '1',
+          SNYK_LOG_LEVEL: 'trace',
+        },
+      },
+    );
+
+    expect(stderr).not.toContain('Basic am9ob');
+    expect(stderr).toContain('Basic ***');
+
+    expect(stderr).not.toContain('john.doe@domain.org');
+    expect(stderr).not.toContain('solidpassword');
+
+    expect(stderr).toContain('"username": "***"');
+    expect(stderr).toContain('"password": "***"');
+  });
+
+  it('redacts short-form basic authentication with trace log level', async () => {
+    const { stderr } = await runSnykCLI(
+      'container test ubuntu:latest -u=john.doe@domain.org -p=solidpassword -d',
       {
         env: {
           ...process.env,
@@ -58,11 +136,37 @@ describe('debug log', () => {
       },
     );
 
-    // this test only makes sense when Basic auth would be expected, otherwise the checks below
-    if (stderr.includes('Basic ')) {
-      expect(stderr).not.toContain('Basic dXM6cHc=');
-      expect(stderr).toContain('Basic ***');
-    }
+    expect(stderr).not.toContain('Basic am9ob');
+    expect(stderr).toContain('Basic ***');
+
+    expect(stderr).not.toContain('john.doe@domain.org');
+    expect(stderr).not.toContain('solidpassword');
+
+    expect(stderr).toContain('-u=***');
+    expect(stderr).toContain('"u": "***"');
+    expect(stderr).toContain('-p=***');
+    expect(stderr).toContain('"p": "***"');
+  });
+
+  it('redacts ENV-driven basic authentication with trace log level', async () => {
+    const { stderr } = await runSnykCLI('container test ubuntu:latest -d', {
+      env: {
+        ...process.env,
+        SNYK_DISABLE_ANALYTICS: '1',
+        SNYK_REGISTRY_USERNAME: 'john.doe@domain.org',
+        SNYK_REGISTRY_PASSWORD: 'solidpassword',
+        SNYK_LOG_LEVEL: 'trace',
+      },
+    });
+
+    expect(stderr).not.toContain('Basic am9ob');
+    expect(stderr).toContain('Basic ***');
+
+    expect(stderr).not.toContain('john.doe@domain.org');
+    expect(stderr).not.toContain('solidpassword');
+
+    expect(stderr).toContain('"REGISTRY_USERNAME": "***"');
+    expect(stderr).toContain('"REGISTRY_PASSWORD": "***"');
   });
 
   it('redacts externally injected bearer token', async () => {
diff --git a/ts-binary-wrapper/src/common.ts b/ts-binary-wrapper/src/common.ts
@@ -181,9 +181,7 @@ export function runWrapper(executable: string, cliArguments: string[]): number {
   const debug = debugEnabled(cliArguments);
 
   if (debug) {
-    logErrorWithTimeStamps(
-      'Executing: ' + executable + ' ' + cliArguments.join(' '),
-    );
+    logErrorWithTimeStamps('Executing: ' + executable);
   }
 
   const res = spawnSync(executable, cliArguments, {

Original file line number	Diff line number	Diff line change
`@@ -181,9 +181,7 @@ export function runWrapper(executable: string, cliArguments: string[]): number {`
`181`	`181`	`const debug = debugEnabled(cliArguments);`
`182`	`182`
`183`	`183`	`if (debug) {`
`184`		`- logErrorWithTimeStamps(`
`185`		`- 'Executing: ' + executable + ' ' + cliArguments.join(' '),`
`186`		`- );`
	`184`	`+ logErrorWithTimeStamps('Executing: ' + executable);`
`187`	`185`	`}`
`188`	`186`
`189`	`187`	`const res = spawnSync(executable, cliArguments, {`