mcp-server-semgrep/semgrep-rules/python/lang/security/audit/logging/logger-credential-leak.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: python-logger-credential-disclosure
  patterns:
  - pattern: |
      $LOGGER_OBJ.$LOGGER_CALL($FORMAT_STRING,...)
  - metavariable-regex:
      metavariable: $LOGGER_OBJ
      regex: (?i)(_logger|logger|self.logger|log)
  - metavariable-regex:
      metavariable: $LOGGER_CALL
      regex: (debug|info|warn|warning|error|exception|critical)
  - metavariable-regex:
      metavariable: $FORMAT_STRING
      regex: (?i).*(api.key|secret|credential|token|password).*\%s.*
  message: >-
    Detected a python logger call with a potential hardcoded secret
    $FORMAT_STRING being logged. This may lead to secret credentials
    being exposed. Make sure that the logger is not logging 
    sensitive information.
  severity: WARNING
  languages: [python]
  metadata:
    cwe:
    - 'CWE-532: Insertion of Sensitive Information into Log File'
    category: security
    technology:
    - python
    owasp:
    - A09:2021 - Security Logging and Monitoring Failures
    references:
    - https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM