Fix sensitive data written to a log in Sails.js

A password, token, cookie, or similar value is passed to a log sink. Centralised logs are widely readable inside an organisation and often retained for months - a credential that lands there is a credential that has left the application's control.

medium likely Sails.js CWE-532 / OWASP A09:2021

The vulnerable pattern in Sails.js

This finding comes from the Sails.js fixture in the owlwarden test suite, in /auth. Logs are copied into aggregators, retained for months, and readable by anyone with access to the logging system. A credential that reaches a log has left the application's trust boundary.

The corrected handler

Use sails.log with a redacted payload.

sails.log.info({ event: 'login_attempt', userId })
// never: sails.log.info({ password: inputs.password })

If you are not using Sails.js

Log a redacted shape - an id, a boolean, a length - never the secret itself.

Check your own repository

npx owlwarden scan
npx owlwarden explain sensitive-data-logged

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Sails.js checks

Rules with a tested Sails.js example.

• cors-permissive medium Cross-origin policy accepts any origin
• hardcoded-secret high Credential hardcoded in source
• insecure-cookie medium Cookie set without its protective attributes
• install-lifecycle-script medium Package declares an install-time script
• open-redirect medium Redirect target comes from the caller
• security-headers-missing medium Security headers are not configured
• sql-injection high SQL query built by string interpolation
• ssrf high Server fetches a URL the caller controls
• stack-trace-leak high Stack trace leaked in error response
• weak-crypto high Broken cryptographic primitive protecting a secret

sensitive-data-logged for every framework / All rules / owlwarden