security: CWE-532: Redact sensitive data from debug logs — VC-53770

[torresashjiancyber]

Summary

Fixed CWE-532 (Insertion of Sensitive Information into Log File) by redacting passwords, tokens, API keys, and private key material from debug log output.

Finding

CWE-532: Secrets in debug log (CVSS: 5.6)

When debug logging is enabled, the SDK was logging plaintext credentials and sensitive data:

• TPP usernames and passwords during authentication
• OAuth bearer tokens and refresh tokens
• API keys (x-venafi-api-key)
• Private key passphrases
• Raw private key material (octet-stream responses)

These secrets were logged at multiple points:

• TPPTokenConnection._post()/_put() logged full request headers (containing Authorization: Bearer <token>) and bodies (containing passwords/passphrases)
• TPPTokenConnection._check_token() logged raw access tokens
• TPPConnection._get()/_post()/_put() logged raw API keys
• CommonConnection.process_server_response() logged raw octet-stream responses containing private keys

Anyone with read access to application logs could recover working Venafi credentials.

Remediation

Applied minimal focused changes to redact sensitive data from log output:

1. vcert/connection_tpp_token.py (lines 129, 149): Create redacted copies of headers and data dictionaries before logging

   • Mask Authorization header value
   • Mask sensitive data keys: password, Password, refresh_token, client_secret, PrivateKeyPassphrase

2. vcert/connection_tpp_token.py (lines 160, 166): Replace raw token values with [REDACTED] placeholder

3. vcert/connection_tpp.py (lines 93, 106, 123): Replace raw API key values with [REDACTED] placeholder

4. vcert/common.py (line 758): Log byte count instead of raw octet-stream content

All changes preserve the original unredacted values in the actual network requests - only the log output is modified.

Verification

Files changed: 3 files, 12 insertions(+), 8 deletions(-)

• vcert/common.py
• vcert/connection_tpp.py
• vcert/connection_tpp_token.py

Impact: No functional changes to SDK behavior. Network requests remain identical. Only debug log output is modified to protect sensitive data.

Testing note: Test suite has pre-existing dependency issues unrelated to these changes (missing six module). The remediation only modifies logging statements and does not affect imports, logic, or network behavior.

---

🤖 Generated with Project Logos Pattern-C security fixer