asf-tooling opened a new issue, #1095: URL: https://github.com/apache/tooling-trusted-releases/issues/1095
**ASVS Level(s):** L2 **Description:** ### Summary During database initialization, the absolute database file path and migrations directory are logged at INFO level. This reveals filesystem layout information that could aid attackers in understanding the deployment structure if logs are exposed. ### Details In `atr/db/__init__.py` at lines 640-645, Alembic URL and script_location are logged at INFO level. ### Recommended Remediation Change `log.info()` to `log.debug()` for Alembic URL and script_location logging. ### Acceptance Criteria - [ ] Database paths logged at DEBUG level only - [ ] INFO level logs do not reveal filesystem layout - [ ] Unit tests verify logging levels ### References - Source reports: L2:13.4.2.md - Related findings: FINDING-291 - ASVS sections: 13.4.2 ### Priority Low --- -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
