Feature/CCM 14508 Metrics not showing for batches #398
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| }; | ||
| const emf = buildEMFObject("postLetters", dimensions, metric); | ||
| logger.info(emf); | ||
| logger.info(`process.env: ${JSON.stringify(process.env)}`); |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 hour ago
In general, the fix is to avoid logging process.env or any other sensitive configuration values in clear text. If the log statement is only for debugging, it should be removed or conditioned on a safe debug flag that is disabled in production, and even then it’s better to avoid full environment dumps. If some environment-related information is needed for diagnostics, log only non-sensitive, whitelisted keys or high-level metadata (e.g., current stage name) rather than the entire environment.
For this specific code, the safest and simplest fix without changing existing functionality is to remove the line that logs process.env inside emitSuccessMetrics. The rest of the metrics logging (logger.info(emf)) remains intact, so the functional behavior of emitting metrics is preserved; only the unsafe logging of environment variables is removed. No additional imports or helper methods are required. Concretely, in lambdas/api-handler/src/handlers/post-letters.ts, delete line 44 (logger.info(\process.env: ${JSON.stringify(process.env)}`);) from the body of emitSuccessMetrics`.
| @@ -41,7 +41,6 @@ | ||
| }; | ||
| const emf = buildEMFObject("postLetters", dimensions, metric); | ||
| logger.info(emf); | ||
| logger.info(`process.env: ${JSON.stringify(process.env)}`); | ||
| } | ||
| } | ||
|
|
2 participants
Description
Context
Type of changes
Checklist
Sensitive Information Declaration
To ensure the utmost confidentiality and protect your and others privacy, we kindly ask you to NOT including PII (Personal Identifiable Information) / PID (Personal Identifiable Data) or any other sensitive data in this PR (Pull Request) and the codebase changes. We will remove any PR that do contain any sensitive information. We really appreciate your cooperation in this matter.