CWE-532: Full config object (secrets, DB URI) logged to stdout on startup

[cgdmrt]

Summary

On every application start, config/config.js logs the entire configuration object to stdout via util.inspect(). This exposes the session cookie secret, cryptographic key, and the MongoDB connection string (which may contain credentials) to anyone with access to application logs.

Vulnerable Code

File: config/config.js, lines 12-13

console.log("Current Config:");
console.log(util.inspect(config, false, null));

Secrets exposed (from config/env/all.js):

cookieSecret: "session_cookie_secret_key_here",
cryptoKey: "a_secure_key_for_crypto_here",
db: process.env.MONGODB_URI || "mongodb://localhost:27017/nodegoat"

Impact

In containerized or cloud deployments, stdout is typically captured by logging infrastructure (CloudWatch, Stackdriver, ELK, etc.) accessible to operations staff who should not have access to:

• The session cookie secret (enables session forgery)
• The cryptographic key (enables decryption of encrypted fields)
• The MongoDB connection string (may contain database credentials)

This is CWE-532 (Insertion of Sensitive Information into Log File).

Relationship to Existing Issues

• PR fix: startup logs stringified objects incorrectly #202 (Liran Tal, 2020) introduced the util.inspect() call as a logging readability improvement. The security implication was not flagged.
• Issue Insecure Default - mongodb connection string #222 covers the insecure default MongoDB connection string value, which is a different concern (CWE-798 hardcoded credentials vs CWE-532 credential logging).
• The A5 tutorial covers HTTP security headers and cookie settings. The A6 tutorial covers data-at-rest encryption. Neither covers credential logging.

Suggested Fix

Remove or gate the config logging behind a debug flag:

if (process.env.NODE_ENV === "development" && process.env.DEBUG_CONFIG) {
    // Redact secrets before logging
    const safeConfig = { ...config };
    safeConfig.cookieSecret = "[REDACTED]";
    safeConfig.cryptoKey = "[REDACTED]";
    if (safeConfig.db && safeConfig.db.includes("@")) {
        safeConfig.db = safeConfig.db.replace(/:\/\/.*@/, "://[REDACTED]@");
    }
    console.log("Current Config:");
    console.log(util.inspect(safeConfig, false, null));
}

[Iamthekin]

Hi! I'd like to work on this issue. My plan is to stop logging the full config object and instead log only non-sensitive settings (redacting cookieSecret, cryptoKey, and any credentials in the DB URI). Happy to adjust based on what the maintainers prefer. Is this free to take?