Skip to content

SQL Server Receiver Obfuscation Security Hardening #47692

@ebrdarSplunk

Description

@ebrdarSplunk

Three data exposure points were identified and need addressing:

Location Risk Fix
obfuscate.go:65 fmt.Println writes raw SQL attribute values from XML query plans to stdout Replace with "?" placeholder; plan processing continues
scraper.go:970 (retrieveValue) logger.Error includes row[column] -- the raw unobfuscated value Change to omit raw value from log; downgraded to Warn
scraper.go:930 (debug log) fmt.Sprintf embeds entire raw row map including query_text and query_plan Convert to structured zap fields (still Debug-only)

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions