[Jay W (JayDoubleu)]

What is being addressed

CodeQL code scanning reports 6 High alerts (58 to 63) for py/clear-text-logging-sensitive-data on main. The alerts are in these locations:

• e2e_tests/resources/deployment.py, lines 134 and 137
• e2e_tests/resources/resource.py, lines 174, 183, 187 and 194

All 6 alerts start from one test value in e2e_tests/unit_tests/test_polling_diagnostics.py, line 187:

secret = "response-secret" * 1000

CodeQL marks this value as sensitive because the variable name is secret. The value is not real data. The test sends it to wait_for() as the operation endpoint and as the operation state. Then the test makes sure that the value does not go into the logs.

The alerts are false positives. A false positive is an alert for a problem that does not exist. The log calls already replace unknown values with <redacted>:

• operation_log_path() returns the path only if the full path matches _OPERATION_PATH, which accepts only UUIDs.
• operation_log_state() returns the state only if the state is in the _OPERATION_STATES set.
• polling_failure_details() returns only fixed data about the response, and no body, URL parameters or authentication headers.

CodeQL does not know that a pattern match or a set lookup removes unsafe values. For this reason, CodeQL reports the alerts.

How is this addressed

• Rename the test variable secret to untrusted_value in test_unknown_paths_and_states_are_redacted_and_bounded. The change is on 3 lines. The test value "response-secret" and the assertions do not change, so the test still makes sure that the value does not go into the logs.
• Make no change to production code. The log calls in deployment.py and resource.py do not change.
• Add a line to CHANGELOG.md.
• Documentation does not need an update, because the change is in a unit test only.
• No template version needs an increment, because the change does not touch a template.

Test results

I ran the CodeQL CLI 2.27.2 locally. CI used the same version for the last code scanning analysis of main. I used the same query suite as the CodeQL workflow (python-code-scanning.qls) on all 381 Python files:

Commit	py/clear-text-logging-sensitive-data alerts	All Python alerts
main (0c5027e9)	6	6
This branch	0	0

These are the commands for the local CodeQL run:

codeql database create /tmp/codeql-py --language=python --source-root=. --overwrite
codeql database analyze /tmp/codeql-py codeql/python-queries:codeql-suites/python-code-scanning.qls \
  --format=sarif-latest --output=/tmp/codeql-py.sarif

I also ran the E2E unit tests and the linters with the same Python version and dependencies as the e2e_helper_tests.yml workflow (Python 3.12, e2e_tests/unit_tests/requirements.txt):

Check	main	This branch
PYTHONPATH=.:e2e_tests python -m unittest discover -s e2e_tests/unit_tests	255 tests, OK	255 tests, OK
ruff check (v0.15.17, as pinned in .pre-commit-config.yaml)	Not run	All checks passed
ruff format --check	Not run	Already formatted

If a later change adds a variable with a name such as secret, password or token, and its data goes into these log calls, CodeQL will report new alerts.

[github-actions]

Unit Test Results

0 tests   0 ✅  0s ⏱️
0 suites  0 💤
0 files    0 ❌

Results for commit bdb0b51.

[Jay W (JayDoubleu)]

/test-force-approve

[github-actions]

🤖 pr-bot 🤖

✅ Marking tests as complete (for commit bdb0b51)

(in response to this comment from Jay W (@JayDoubleu))