Skip to content

Feature nuxt v3 upgrade#285

Open
seeker25 wants to merge 252 commits intomainfrom
feature-nuxt-v3-upgrade
Open

Feature nuxt v3 upgrade#285
seeker25 wants to merge 252 commits intomainfrom
feature-nuxt-v3-upgrade

Conversation

@seeker25
Copy link
Copy Markdown
Collaborator

No description provided.

@bcregistry-sre
Copy link
Copy Markdown
Collaborator

Temporary Url for review: https://pay-web-dev--pr-285-xi553ou5.web.app

@ochiu
Copy link
Copy Markdown
Collaborator

ochiu commented Mar 3, 2026

/gcbrun

@bcregistry-sre
Copy link
Copy Markdown
Collaborator

Temporary Url for review: https://pay-web-dev--pr-285-xi553ou5.web.app

Co-authored-by: Your Name <your.email@example.com>

async function performLoginAndSaveSession(page, context, baseURL, loginType, username, password) {
await page.goto(baseURL)
console.log(`Global setup: loginType=${loginType}, username=${username}`)

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High test

This logs sensitive data returned by process environment as clear text.
This logs sensitive data returned by process environment as clear text.
This logs sensitive data returned by process environment as clear text.
This logs sensitive data returned by process environment as clear text.

Copilot Autofix

AI 29 days ago

In general, to fix clear-text logging of sensitive information, remove sensitive values from log messages or replace them with non-sensitive, redacted, or generalized information. Keep logging high-level status (e.g., loginType, environment, success/failure) without printing secrets or identifiers derived from environment variables used for authentication.

For this specific issue, the problematic sink is on line 106:

console.log(`Global setup: loginType=${loginType}, username=${username}`)

The best fix that preserves functionality is to stop logging the raw username. We can still log loginType and, if helpful, a non-sensitive indicator that a username was used or a redacted form (e.g., masking all but the first character). Since we must avoid assuming extra utility functions elsewhere, the simplest and safest change is to remove username from the log entirely:

console.log(`Global setup: Starting login using loginType=${loginType}`)

This ensures no environment-derived credential is written to logs while maintaining useful debug information. No new imports or helper methods are required; the change is limited to the single log line in performLoginAndSaveSession in test-automation/globalSetup.js.


Suggested changeset 1
test-automation/globalSetup.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/test-automation/globalSetup.js b/test-automation/globalSetup.js
--- a/test-automation/globalSetup.js
+++ b/test-automation/globalSetup.js
@@ -103,7 +103,7 @@
 
 async function performLoginAndSaveSession(page, context, baseURL, loginType, username, password) {
   await page.goto(baseURL)
-  console.log(`Global setup: loginType=${loginType}, username=${username}`)
+  console.log(`Global setup: Starting login using loginType=${loginType}`)
 
 
   const loginPage = new LoginPage(page)
EOF
@@ -103,7 +103,7 @@

async function performLoginAndSaveSession(page, context, baseURL, loginType, username, password) {
await page.goto(baseURL)
console.log(`Global setup: loginType=${loginType}, username=${username}`)
console.log(`Global setup: Starting login using loginType=${loginType}`)


const loginPage = new LoginPage(page)
Copilot is powered by AI and may make mistakes. Always verify output.
@seeker25 seeker25 committed this autofix suggestion 29 days ago.
Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

…ensitive information

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@bcregistry-sre

This comment was marked as outdated.

ochiu added 2 commits March 12, 2026 15:50
* fix decimal point validation

* button hide / show logic update and linting

* lint

* lint, test fixes / updates
@ochiu
Copy link
Copy Markdown
Collaborator

ochiu commented Mar 17, 2026

/gcbrun

@bcgov bcgov deleted a comment from bcregistry-sre Mar 17, 2026
@bcgov bcgov deleted a comment from bcregistry-sre Mar 17, 2026
@bcregistry-sre
Copy link
Copy Markdown
Collaborator

Temporary Url for review: https://pay-web-dev--pr-285-4pbohven.web.app

* 32196 - EFT UX / QA clean up

* test fix
@ochiu
Copy link
Copy Markdown
Collaborator

ochiu commented Mar 24, 2026

/gcbrun

@bcregistry-sre
Copy link
Copy Markdown
Collaborator

Temporary Url for review: https://pay-web-dev--pr-285-4pbohven.web.app

* 32196 - EFT UX / QA clean up

* test fix

* 32196 - EFT UXA Review 2
@ochiu
Copy link
Copy Markdown
Collaborator

ochiu commented Mar 25, 2026

/gcbrun

@bcregistry-sre
Copy link
Copy Markdown
Collaborator

Temporary Url for review: https://pay-web-dev--pr-285-4pbohven.web.app

anisshhbatrra and others added 3 commits March 30, 2026 09:13
@ochiu
Copy link
Copy Markdown
Collaborator

ochiu commented Mar 31, 2026

/gcbrun

@bcregistry-sre
Copy link
Copy Markdown
Collaborator

Temporary Url for review: https://pay-web-dev--pr-285-4pbohven.web.app

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

9 participants