T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/validate.py:464- Finding
PII Validator Discloses Sensitive Values in Plaintext Logs
- Content
View full analysis
Dict[str, List[Tuple[int, str, str]]]: """Scan all string fields for PII patterns. Returns findings dict.""" patterns = dict(DEFAULT_PII_PATTERNS) if include_contextual: patterns.update(CONTEXTUAL_PII_PATTERNS) findings: Dict[str, List[Tuple[int, str, str]]] = { k: [] for k in patterns } for i, row in enumerate(rows): for field, val in row.items(): if not isinstance(val, str): continue for pii_type, pattern in patterns.items(): for m in pattern.finditer(val): if pii_type == "credit_card" and not _luhn_ok(m.group()): continue findings[pii_type].append((i, field, m.group())) break return findings ``` The collected sensitive value is subsequently printed without masking: ```python for row_idx, field, match in hits[:3]: print(f" row {row_idx}.{field}: {match!r}") ``` ### Technical Analysis The PII scanner collects the complete regex match through `m.group()`. This may contain an email address, telephone number, Social Security number, or Luhn-valid payment-card number. The reporting logic then writes up to three complete values from each finding category to standard output. A validation report does not need the complete sensitive value to identify the affected record. The row index, field name, PII type, and a masked suffix are sufficient for remediation. Printing the complete value violates data minimization and expands the number of systems holding the sensitive information. Although the script does not di ...[truncated 1872 chars]- Remediation
View remediation
str: if pii_type in {"us_ssn", "credit_card", "us_phone"}: digits = re.sub(r"\D", "", value) return f"***{digits[-4:]}" if len(digits) >= 4 else "***" if pii_type == "email": local, _, domain = value.partition("@") return f"{local[:1]}***@{domain}" if domain else "***" return "***" for row_idx, field, match in hits[:3]: print( f" row {row_idx}.{field}: " f"{mask_match(pii_type, match)!r}" ) ``` ]]>