T09 · Insecure Skill Coding Practices
Warning
- Location
- references/bethune-patterns.md:91
- Finding
- Untrusted Kafka Payload Logged Without Redaction## Vulnerability Details **File Location**: `references/bethune-patterns.md`, lines 91–92 **Vulnerability Type**: Sensitive information exposure and log injection through unsafe error logging **Risk Level**: Medium ### Vulnerable Code ```java LOG.error("任务{N}解析logTime失败，按A方案丢弃。id={}, logTime={}, message={}", skyNetVo.getId(), logTime, skyNetVo.getMessage(), ex); ``` ### Technical Analysis The prescribed Java template records the complete value of `skyNetVo.getMessage()` when parsing `logTime` fails. Because the message originates from Kafka, its contents must be treated as untrusted and potentially sensitive. A producer able to submit Kafka records can deliberately provide an invalid `logTime` to reach this error path. The associated message is then copied into application and centralized logs without redaction, truncation, or control-character sanitization. This can expose personal data, credentials, tokens, internal business information, or other confidential payload fields. Embedded newline and control characters may also forge or corrupt log entries, depending on the logging pipeline and encoder. As this file is a code-generation reference, the vulnerable pattern may be reproduced across every generated Flink job that adopts the template. ### Attack Path 1. An attacker, compromised producer, or faulty upstream service publishes a Kafka record processed by a generated Flink job. 2. The record contains a malformed or otherwise unparsable `logTime`. 3. The record's `message` field contains sensitive information or crafted newline/control-character content. 4. `LocalDateTime.parse()` raises an exception. 5. The exception handler logs the complete `message` value. 6. The payload is retained in local or centralized logging infrastructure, where it may be exposed to log users or interfere with log integrity. ### Impact Assessment This issue does not directly grant additional system privileges. Its scope is confidentiality and log integrity: - Co ...[truncated 435 chars]
- Remediation
- ## Remediation Suggestions Remove the complete message payload from the error log. Record only non-sensitive identifiers and the minimum metadata needed to diagnose the parsing failure: ```java LOG.error( "Task {} failed to parse logTime; record discarded. id={}, module={}, category={}, subCategory={}", TASK_NUMBER, skyNetVo.getId(), skyNetVo.getModule(), skyNetVo.getCategory(), skyNetVo.getSubCategory(), ex ); ``` Apply the following additional controls: 1. Never log raw Kafka payloads in normal production error paths. 2. If payload diagnostics are strictly necessary, allow them only in a protected debug mode. 3. Redact credentials, tokens, personal data, and other sensitive fields before logging. 4. Strip newline and control characters to protect log integrity. 5. Enforce a conservative maximum logged-field length. 6. Restrict and audit access to centralized logs and align retention with data-classification requirements. 7. Update both the reference template and any previously generated jobs containing the same logging statement. 8. Add static-analysis or review checks that reject logging calls containing raw message bodies.