T09 · Insecure Skill Coding Practices
Warning
- Location
- references/http-middlewares.md:44
- Finding
- Request-body logging example can disclose credentials and personal data to downstream log sinks## Vulnerability Details **File Location**: `references/http-middlewares.md`, lines 44-54 **Vulnerability Type**: Sensitive data exposure through unsafe logging guidance **Risk Level**: Medium ### Vulnerable Code ```go // With config router.Use(sloggin.NewWithConfig(logger, sloggin.Config{ DefaultLevel: slog.LevelInfo, ClientErrorLevel: slog.LevelWarn, ServerErrorLevel: slog.LevelError, WithRequestBody: true, WithUserAgent: true, Filters: []sloggin.Filter{ sloggin.IgnorePath("/health", "/metrics"), sloggin.IgnorePathPrefix("/static"), }, })) ``` The same unsafe `WithRequestBody: true` pattern is repeated for Echo, Fiber, and Chi in this file. `SKILL.md` also presents request-body logging as an ordinary middleware configuration option without requiring endpoint filtering or content redaction. ### Technical Analysis Enabling `WithRequestBody` causes request payloads to become log attributes. Request bodies commonly contain passwords, session tokens, API keys, payment information, identity data, and other regulated personal information. The documented 64 KB maximum only limits volume; it does not provide confidentiality or remove secrets. This Skill is specifically designed to route records to remote backends such as Sentry, Loki, Datadog, Slack, webhooks, Kafka, and cloud object storage. Consequently, following this example can cause request secrets to cross the process and trust boundary and be retained by third-party or shared logging infrastructure. Although the middleware defaults this option to `false`, the prominent framework examples explicitly enable it without showing redaction, allowlisting safe routes, excluding authentication and payment endpoints, or warning against production use. This exceeds the minimum data collection needed for ordinary HTTP request logging, for which method, path, status, latency, and payload length are sufficient. The sta ...[truncated 1973 chars]
- Remediation
- ## Remediation Suggestions 1. Keep `WithRequestBody` and `WithResponseBody` disabled in the default and primary examples: ```go WithRequestBody: false, WithResponseBody: false, ``` 2. Add an explicit warning that body logging should not be enabled globally in production and that size limits do not constitute redaction. 3. If body logging is necessary for troubleshooting, use an allowlist of known-safe endpoints and content types. Always exclude authentication, token, payment, upload, and personal-data routes. 4. Sanitize records before routing them to any sink. Redact values by schema and key, including passwords, tokens, authorization data, cookies, secrets, email addresses, IP addresses, and payment fields. Ensure sanitization wraps all downstream handlers. 5. Prefer structured, non-sensitive diagnostic fields such as body size, schema-validation result, content type, and a correlation identifier rather than the raw payload. 6. Document safe handling for the Sentry `request` attribute. Remove or redact authorization headers, cookies, sensitive query parameters, and request bodies before attaching a request object. 7. Add tests with representative secret values to verify that no configured sink receives raw credentials or personal information. 8. Apply least-privilege access, short retention periods, encryption in transit and at rest, and auditing to every remote logging backend. These controls are defense in depth and do not replace source-side minimization and redaction.