logos-co/logos-protocol
1
0
Fork 0
mirror of https://github.com/logos-co/logos-protocol.git synced 2026-08-30 21:41:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: don't log call arguments in plaintext in ModuleProxy (#10)

Browse Source 
ModuleProxy::callRemoteMethod is the choke point every cross-module call
passes through on the callee side. It logged the full QVariantList of
arguments at debug level, which dumped secrets — mnemonics, passwords,
auth tokens, key material — into module logs in plaintext.

Log only the argument count, matching the other transport call sites
(LogosAPIClient/LogosAPIConsumer/LocalLogosObject/RemoteLogosObject all
already log args.size() only).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Dario Lipicar
2026-06-30 14:53:31 -03:00
committed by GitHub
co-authored by Claude Opus 4.8
parent d5d58e7e23
commit 976bc7a9a0
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cpp/module_proxy.cpp
+4 -1
View File
@@ -99,7 +99,10 @@ QVariant ModuleProxy::callRemoteMethod(const QString& authToken, const QString&
return QVariant();
}
qDebug() << "ModuleProxy: callRemoteMethod" << methodName << "args:" << args;
// SECURITY: never log call arguments — they routinely carry secrets
// (mnemonics, passwords, tokens, key material). Log only the method name and
// the argument count, matching the other transport call sites.
qDebug() << "ModuleProxy: callRemoteMethod" << methodName << "args:" << args.size();
return m_provider->callMethod(methodName, args);
}