Description

This detector identifies instances where sensitive information may be logged in Elixir applications. When developers log user inputs or variables containing sensitive data like passwords, tokens, or personal information, this creates a security risk as logs are often stored in plaintext and may be accessible to unauthorized parties.

Detection Strategy

• The analyzer triggers when the Logger library is imported in the Elixir code

• It examines all function calls in the code to identify Logger method calls (e.g., Logger.info, Logger.debug, Logger.error)

• For each Logger call found, it analyzes the arguments passed to determine if they contain potentially dangerous or sensitive data

• A vulnerability is reported when a Logger function call contains arguments that may expose sensitive information in log outputs

Vulnerable code example

defmodule VulnerableLogging do
  require Logger

  def login(conn) do
    password = conn.body_params["password"]
    # VULNERABLE: Logs sensitive data in cleartext
    Logger.info("Login attempt with password #{password}")
  end...

✅ Secure code example

defmodule VulnerableLogging do
  require Logger

  def login(conn) do
    password = conn.body_params["password"]
    # SAFE: Redact sensitive data before logging
    Logger.info("Login attempt with password #{redact_secret(password)}")
  end...