Description

This detector identifies potential exposure of sensitive information through Log4js logging statements in TypeScript applications. When sensitive data like passwords, tokens, or personal information is logged, it can be exposed in log files, creating security risks including data breaches and compliance violations.

Detection Strategy

• The detector triggers when Log4js logging methods (such as logger.info(), logger.debug(), logger.warn(), etc.) are called with arguments that may contain sensitive information

• It analyzes the content being logged to identify patterns that suggest sensitive data, such as variables with names containing 'password', 'token', 'key', 'secret', or similar sensitive terms

• The detection occurs at the point where potentially sensitive data is passed as arguments to Log4js logging functions in TypeScript code

Vulnerable code example

import log4js from 'log4js';

const logger = log4js.getLogger();

const apiKey = "sk-1234567890abcdef";
const password = "secretPass123";

// Vulnerable: logging sensitive data directly...

✅ Secure code example

import log4js from 'log4js';

const logger = log4js.getLogger();

const apiKey = "sk-1234567890abcdef";
const password = "secretPass123";

// Safe: redact sensitive data before logging...