Go, Swift: Update dead link in .qhelp

[geoffw0]

Replace a dead link in the cleartext logging .qhelp (two language versions).

[github-actions]

QHelp previews:

go/ql/src/Security/CWE-312/CleartextLogging.qhelp

Clear-text logging of sensitive information

Sensitive information that is logged unencrypted is accessible to an attacker who gains access to the logs.

Recommendation

Ensure that sensitive information is always encrypted or obfuscated before being logged.

In general, decrypt sensitive information only at the point where it is necessary for it to be used in cleartext.

Be aware that external processes often store the standard out and standard error streams of the application, causing logged sensitive information to be stored.

Example

The following example code logs user credentials (in this case, their password) in plain text:

package main

import (
	"log"
	"net/http"
)

func serve() {
	http.HandleFunc("/register", func(w http.ResponseWriter, r *http.Request) {
		r.ParseForm()
		user := r.Form.Get("user")
		pw := r.Form.Get("password")

		log.Printf("Registering new user %s with password %s.\n", user, pw)
	})
	http.ListenAndServe(":80", nil)
}

Instead, the credentials should be encrypted, obfuscated, or omitted entirely:

package main

import (
	"log"
	"net/http"
)

func serve1() {
	http.HandleFunc("/register", func(w http.ResponseWriter, r *http.Request) {
		r.ParseForm()
		user := r.Form.Get("user")
		pw := r.Form.Get("password")

		log.Printf("Registering new user %s.\n", user)

		// ...
		use(pw)
	})
	http.ListenAndServe(":80", nil)
}

References

• M. Dowd, J. McDonald and J. Schuhm, The Art of Software Security Assessment, 1st Edition, Chapter 2 - 'Common Vulnerabilities of Encryption', p. 43. Addison Wesley, 2006.
• M. Howard and D. LeBlanc, Writing Secure Code, 2nd Edition, Chapter 9 - 'Protecting Secret Data', p. 299. Microsoft, 2002.
• OWASP: Logging Cheat Sheet.
• Common Weakness Enumeration: CWE-312.
• Common Weakness Enumeration: CWE-315.
• Common Weakness Enumeration: CWE-359.

swift/ql/src/queries/Security/CWE-312/CleartextLogging.qhelp

Cleartext logging of sensitive information

Attackers could gain access to sensitive information that is logged unencrypted.

Recommendation

Always make sure to encrypt or obfuscate sensitive information before you log it.

Generally, you should decrypt sensitive information only at the point where it is necessary for it to be used in cleartext.

Be aware that external processes often store the standard output and standard error streams of the application. This will include logged sensitive information.

Example

The following example code logs user credentials (in this case, their password) in plaintext:

let password = "P@ssw0rd"
NSLog("User password changed to \(password)")

Instead, you should encrypt or obfuscate the credentials, or omit them entirely:

let password = "P@ssw0rd"
NSLog("User password changed")

References

• M. Dowd, J. McDonald and J. Schuhm, The Art of Software Security Assessment, 1st Edition, Chapter 2 - 'Common Vulnerabilities of Encryption', p. 43. Addison Wesley, 2006.
• M. Howard and D. LeBlanc, Writing Secure Code, 2nd Edition, Chapter 9 - 'Protecting Secret Data', p. 299. Microsoft, 2002.
• OWASP: Logging Cheat Sheet.
• Common Weakness Enumeration: CWE-312.
• Common Weakness Enumeration: CWE-359.
• Common Weakness Enumeration: CWE-532.

[Copilot]

Copilot review overview

🟢 Approval recommended

Both reviewed files update the dead reference with no unresolved issues.

Review tier: Lite (auto)
Findings: None

Note

Copilot is running an experiment and ran this review at Lite.

What changed in this PR

Updates the dead OWASP reference in the Go and Swift cleartext logging query help files.

Changes:

• Replaces the obsolete link with OWASP’s Logging Cheat Sheet.
• Keeps both language versions aligned.

File	Description
swift/​ql/​src/​queries/​Security/​CWE-312/​CleartextLogging.qhelp	Updates the OWASP reference link.
go/​ql/​src/​Security/​CWE-312/​CleartextLogging.qhelp	Updates the OWASP reference link.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.