Potential fix for code scanning alert no. 98: Clear-text logging of sensitive information

[intel352]

Potential fix for https://github.com/GoCodeAlone/modular/security/code-scanning/98

In general, to fix clear‑text logging of sensitive information, avoid logging the raw value. Either remove it from the log entirely, or transform it irreversibly (e.g., hash with a strong cryptographic hash) so that operators can correlate events without being able to recover the original sensitive data. Do not decrypt or otherwise materialize sensitive data just to log it, and keep logs free of directly identifying information where possible.

For this specific case, the best fix that minimally changes behavior is to stop logging the raw tenant ID and instead log a deterministic hash of it. This lets you still distinguish between different tenants in logs (same tenant → same hash) without exposing the actual identifier. Since crypto/sha256 and encoding/hex are already imported at the top of module.go, we can reuse them without adding dependencies. We will replace the construction of safeTenantID and its use in the log call with a hashed representation, for example tenantHash := sha256.Sum256([]byte(tenantID)) and log hex.EncodeToString(tenantHash[:]) under a new key like "tenant_hash" (or, if you prefer, keep the key "tenant" but ensure the value is clearly a hash). All changes are confined to the shown block around line 1788 in modules/reverseproxy/module.go.

Concretely:

• In modules/reverseproxy/module.go, locate the block that builds safeTenantID (the double strings.ReplaceAll) and logs "tenant", safeTenantID.
• Replace that with code that:
  • Computes a SHA‑256 hash of the tenantID (only when hasTenant is true; for the empty case we can skip or log "unknown" / empty).
  • Logs the hex‑encoded hash instead of the original value.
• Keep the rest of the error handling logic intact.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[github-actions]

📋 API Contract Changes Summary

✅ No breaking changes detected - only additions and non-breaking modifications

Changed Components:

Core Framework

Contract diff saved to artifacts/diffs/core.json

Module: auth

Contract diff saved to artifacts/diffs/auth.json

Module: cache

Contract diff saved to artifacts/diffs/cache.json

Module: chimux

Contract diff saved to artifacts/diffs/chimux.json

Module: configwatcher

Contract diff saved to artifacts/diffs/configwatcher.json

Module: database

Contract diff saved to artifacts/diffs/database.json

Module: eventbus

Contract diff saved to artifacts/diffs/eventbus.json

Module: eventlogger

Contract diff saved to artifacts/diffs/eventlogger.json

Module: httpclient

Contract diff saved to artifacts/diffs/httpclient.json

Module: httpserver

Contract diff saved to artifacts/diffs/httpserver.json

Module: jsonschema

Contract diff saved to artifacts/diffs/jsonschema.json

Module: letsencrypt

Contract diff saved to artifacts/diffs/letsencrypt.json

Module: logmasker

Contract diff saved to artifacts/diffs/logmasker.json

Module: reverseproxy

Contract diff saved to artifacts/diffs/reverseproxy.json

Module: scheduler

Contract diff saved to artifacts/diffs/scheduler.json

Artifacts

📁 Full contract diffs and JSON artifacts are available in the workflow artifacts.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

Updates reverseproxy module logging to avoid exposing tenant identifiers when response header modification fails, aligning with privacy/security goals in a multi-tenant reverse proxy.

Changes:

• Replace plaintext/sanitized tenant ID logging with a hashed representation in ModifyResponse error logging.

[Copilot]

This log line manually computes a full SHA-256 hex string for the tenant ID, but this file already defines and consistently uses obfuscateTenantID(tenantID) for tenant_hash logging (and it intentionally truncates for brevity). Reuse the helper here (and consider logging the field only when hasTenant is true) to keep tenant hashing consistent across the module and avoid duplicated hashing logic.

Suggested change

	// Log a hashed representation of the tenant ID to avoid exposing it in clear text
	tenantHashStr := ""
	if hasTenant {
	sum := sha256.Sum256([]byte(tenantID))
	tenantHashStr = hex.EncodeToString(sum[:])
	}
	m.app.Logger().Error("Response header modifier error", "backend", backendID, "tenant_hash", tenantHashStr, "error", err.Error())
	// Log an obfuscated representation of the tenant ID to avoid exposing it in clear text
	if hasTenant {
	m.app.Logger().Error(
	"Response header modifier error",
	"backend", backendID,
	"tenant_hash", obfuscateTenantID(tenantID),
	"error", err.Error(),
	)
	} else {
	m.app.Logger().Error(
	"Response header modifier error",
	"backend", backendID,
	"error", err.Error(),
	)
	}