VNX-779: Logging of Excessive Data

Root logging at DEBUG/TRACE/ALL, wire-level HTTP or SQL-parameter logging, and whole-environment dumps in production code and configuration.

Field	Value
Rule ID	`VNX-779`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java, Kotlin, Python, JavaScript / TypeScript, Config files
CWE	CWE-779
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`excessive-logging` `debug-logging` `cwe-779`
Source	`internal/sast/rules/vnx-779.rego`

Overview

VNX-779 maps to CWE-779: Logging of Excessive Data. It reports production code or configuration that logs far more than an operator needs:

Python logging.basicConfig(level=DEBUG) and root-logger setLevel(DEBUG), and HTTPConnection.debuglevel above 0
Java root-logger setLevel(Level.DEBUG/TRACE/ALL) and Configurator.setRootLevel of those; OkHttp HttpLoggingInterceptor.Level.BODY in Java or Kotlin
logging.level.root=DEBUG, log4j rootLogger at DEBUG/TRACE/ALL, Hibernate bind-parameter loggers at TRACE/DEBUG, show-sql: true, and <root level="debug"> in logback/log4j2 XML
a log call whose argument is the whole environment: os.environ, process.env, System.getenv(), System.getProperties()

Not reported: levels chosen by a debug/verbose flag, if __name__ == "__main__" blocks, BuildConfig.DEBUG, dev/local/test profile files (application-dev.properties, logback-test.xml), named application loggers at DEBUG, single environment variables and test files.

Why This Matters

Debug-level root logging and wire logging record request bodies, tokens and bound SQL parameters, and the volume buries the events that matter. An environment dump writes every secret the process holds into the log.

What Gets Flagged

logging.basicConfig(level=logging.DEBUG, filename="app.log")   # FLAGGED

log.info("Environment: {}", System.getenv());                   // FLAGGED

logging.level.org.hibernate.type.descriptor.sql=TRACE           # FLAGGED

Remediation

Log at INFO in production and raise individual loggers only while diagnosing.
Log the specific settings that matter, never the whole environment.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-779
// nosec vnx-779

Or record an ignore rule: vulnetix ignore add --rule vnx-779 --reason "...". See Suppressing findings.