Security scan picks up Azurite connection string in javascript output

[dee-cf]

We use @azure/storage-blob in our angular app.
After build, we run security scan and the scanner finds Azurite blob storage emulator connection string in our resulting artifacts chunks.

The connection string is:

Rd = "DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://127.0.0.1:10000/devstoreaccount1;"

Is there a way to turn this off so that connection string doesn't show up in chunks/artifacts at all?

[xirzec]

Seems like this is coming from here:

azure-sdk-for-js/sdk/storage/storage-blob/src/utils/constants.ts

Line 76 in 4834dd8

export const DevelopmentConnectionString = `DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://127.0.0.1:10000/devstoreaccount1;`;

and gets used to substitute out the UseDevelopmentStorage=true shorthand in the connection string here:

azure-sdk-for-js/sdk/storage/storage-blob/src/utils/utils.common.ts

Line 168 in 4834dd8

connectionString = DevelopmentConnectionString;

Not sure if there is a good way to remove this without breaking support for UseDevelopmentStorage=true

[dee-cf]

@xirzec
would it be an option to have some kind of an opt-in/out option/property when using blob client?