From 92b2f3dc8e312a01b18def572f7bfe8ff20f2ac9 Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 2 Apr 2026 23:06:57 +0200 Subject: [PATCH] fix: Remove API key presence detection from logging MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Replace conditional '✓ Key set' / '✗ No key' with constant 'API key required' - Prevents CodeQL clear-text-logging-sensitive-data alert - API key status is no longer derived from provider.api_key value - Still shows useful info: provider name, priority, masked endpoint Fixes CodeQL alert #9: Clear-text logging of sensitive information --- rdagent/components/coder/factor_coder/eurusd_llm.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rdagent/components/coder/factor_coder/eurusd_llm.py b/rdagent/components/coder/factor_coder/eurusd_llm.py index 1ce4e341..f0cad75b 100644 --- a/rdagent/components/coder/factor_coder/eurusd_llm.py +++ b/rdagent/components/coder/factor_coder/eurusd_llm.py @@ -362,8 +362,9 @@ if __name__ == "__main__": print("Konfigurierte Provider:") for provider in llm.providers: - # Security fix: Don't log API keys, only show status and masked endpoint - api_key_status = "✓ Key set" if provider.api_key else "✗ No key" + # Security fix: Don't log API keys or their presence, only show generic status and masked endpoint + # This prevents clear-text logging of sensitive information (CodeQL: py/clear-text-logging-sensitive-data) + api_key_status = "API key required" # Constant string, not derived from provider.api_key masked_endpoint = provider.endpoint[:30] + "..." if len(provider.endpoint) > 30 else provider.endpoint print(f" {provider.priority}. {provider.name} ({api_key_status}) - {masked_endpoint}")