sneak/AutistMask
1
0
Fork 0
Code Issues 67 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

harden: runtime debug mode logs full request URLs and bodies, which can include RPC credentials #410

New Issue
Open
opened 2026-09-21 20:37:57 +02:00 by clawbot · 0 comments
clawbot commented 2026-09-21 20:37:57 +02:00
Collaborator
Copy Link
Copy Source

Severity: privacy.

Where. src/shared/log.js:45-53 (debugFetch logs the method, URL and body
at debug level); src/popup/views/settings.js:410-416 (the settings toggle
raises the runtime log level).

What is wrong. With debug mode on, every RPC and explorer request is logged
to the console with its full URL and request body. A user who has configured an
RPC endpoint with a key or token embedded in the URL writes that secret to the
browser console, where it persists in logs. The README says debug mode raises
the log level (true), but does not state this consequence.

Why it matters. A configured RPC URL bearing a credential is exposed in the
console log whenever debug mode is on.

Reproduction. Configure an RPC URL containing a token; enable debug mode;
open the extension console — the URL with the token is printed on every request.

Acceptable. Log the request origin and path without the query string (and
without any credential-bearing path segment) in debugFetch, or state the
consequence next to the debug toggle.

Definition of done.

  • debugFetch does not log URL query strings (or otherwise redacts
    credentials) by default.
  • If any URL detail is still logged, the debug toggle's help text states it.
  • A test asserts a tokened URL is not logged verbatim.

Model: fable-5-1 (review); opus-4-8 (filing)

Severity: privacy. **Where.** `src/shared/log.js:45-53` (`debugFetch` logs the method, URL and body at debug level); `src/popup/views/settings.js:410-416` (the settings toggle raises the runtime log level). **What is wrong.** With debug mode on, every RPC and explorer request is logged to the console with its full URL and request body. A user who has configured an RPC endpoint with a key or token embedded in the URL writes that secret to the browser console, where it persists in logs. The README says debug mode raises the log level (true), but does not state this consequence. **Why it matters.** A configured RPC URL bearing a credential is exposed in the console log whenever debug mode is on. **Reproduction.** Configure an RPC URL containing a token; enable debug mode; open the extension console — the URL with the token is printed on every request. **Acceptable.** Log the request origin and path without the query string (and without any credential-bearing path segment) in `debugFetch`, or state the consequence next to the debug toggle. **Definition of done.** - [ ] `debugFetch` does not log URL query strings (or otherwise redacts credentials) by default. - [ ] If any URL detail is still logged, the debug toggle's help text states it. - [ ] A test asserts a tokened URL is not logged verbatim. Model: fable-5-1 (review); opus-4-8 (filing)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
merge-ready
needs-checks
needs-rebase
needs-review
needs-rework
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/AutistMask#410