gavindiaz/NexQuant
1
0
Fork 0
mirror of https://github.com/NicolasBohn/NexQuant.git synced 2026-07-27 15:37:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Remove API key presence detection from logging

Browse Source 
- Replace conditional '✓ Key set' / '✗ No key' with constant 'API key required'
- Prevents CodeQL clear-text-logging-sensitive-data alert
- API key status is no longer derived from provider.api_key value
- Still shows useful info: provider name, priority, masked endpoint

Fixes CodeQL alert #9: Clear-text logging of sensitive information
This commit is contained in:
TPTBusiness
2026-04-02 23:06:57 +02:00
parent 8e00b89996
commit adba526e94
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rdagent/components/coder/factor_coder/eurusd_llm.py
+3 -2
View File
@@ -362,8 +362,9 @@ if __name__ == "__main__":
print("Konfigurierte Provider:")
for provider in llm.providers:
# Security fix: Don't log API keys, only show status and masked endpoint
api_key_status = "✓ Key set" if provider.api_key else "✗ No key"
# Security fix: Don't log API keys or their presence, only show generic status and masked endpoint
# This prevents clear-text logging of sensitive information (CodeQL: py/clear-text-logging-sensitive-data)
api_key_status = "API key required" # Constant string, not derived from provider.api_key
masked_endpoint = provider.endpoint[:30] + "..." if len(provider.endpoint) > 30 else provider.endpoint
print(f" {provider.priority}. {provider.name} ({api_key_status}) - {masked_endpoint}")