Patched code sample

import logging
import sys

# The vulnerability described (for a fictional CVE) is that a logging redactor
# would unconditionally convert all log arguments to strings before formatting.
# This causes a TypeError when a format string like "%d" expects a number
# but receives a string.
#
# The code below demonstrates the FIX for such a vulnerability. The key is that
# the filter now inspects arguments and only modifies them if they need redaction,
# preserving the original type of all other arguments.

SENSITIVE_KEY = "secret-api-key-12345"

class FixedRedactingFilter(logging.Filter):
    """
    A logging filter that correctly redacts sensitive data while preserving
    the original type of non-sensitive arguments, thus preventing TypeErrors.
    """

    def filter(self, record):
        # The vulnerable version would have unconditionally converted all args:
        #
        #   if isinstance(record.args, tuple):
        #       record.args = tuple(str(arg) for arg in record.args)
        #
        # This would cause `logger.info("ID: %d", 100)` to fail because 100
        # would become "100", which is incompatible with the %d format specifier.

        # THE FIX:
        # Process arguments selectively. If an argument does not need redaction,
        # its original type is preserved.
        if isinstance(record.args, tuple) and record.args:
            processed_args = []
            for arg in record.args:
                # Check if the argument needs redaction.
                if str(arg) == SENSITIVE_KEY:
                    processed_args.append("***REDACTED***")
                else:
                    # CRITICAL: Pass the argument through with its original type.
                    processed_args.append(arg)
            record.args = tuple(processed_args)

        # Also redact the formatted message itself, in case sensitive data
        # was not passed as a separate argument.
        if isinstance(record.msg, str):
            record.msg = record.msg.replace(SENSITIVE_KEY, "***REDACTED***")

        return True


# --- Demonstration of the fixed code ---

# 1. Configure a logger
logger = logging.getLogger('FixedRedactorDemo')
logger.setLevel(logging.INFO)

# 2. Create a stream handler and apply the fixed filter
handler = logging.StreamHandler(sys.stdout)
handler.addFilter(FixedRedactingFilter())
formatter = logging.Formatter('%(name)s - %(levelname)s - %(message)s')
handler.setFormatter(formatter)

# 3. Clear any existing handlers and add the new configured handler
if logger.hasHandlers():
    logger.handlers.clear()
logger.addHandler(handler)


print("--- Demonstrating the fix ---")

# This call would have raised a TypeError in the vulnerable version.
# With the fix, the integer `404` is preserved and formatting succeeds.
print("\n[1] Logging an integer with a %d specifier:")
logger.info("Request for user_id %d failed.", 404)

# This call demonstrates that redaction of sensitive arguments still works.
print("\n[2] Logging a sensitive string argument:")
logger.info("Connection failed with API key: %s", SENSITIVE_KEY)

# This call demonstrates a mix of argument types.
# The integer is preserved, and the sensitive string is redacted.
print("\n[3] Logging a mix of integer and sensitive string arguments:")
logger.info("User %d attempted to use key %s.", 123, SENSITIVE_KEY)

# This call demonstrates redaction when sensitive data is part of the message string.
print("\n[4] Logging sensitive data embedded directly in the message string:")
logger.info(f"Invalid operation with key {SENSITIVE_KEY} for account 987.")