You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The fuel-core node imports logging macros (like info!, warn!, or error!) from the log facade instead from the tracing. Messages logged through the log facade do not get printed to the terminal and get ignored silently. Both facades are provided by the respective dependencies tracing and log.
The following code highlights a wrong import.
Figure 21.1: Import from the log facade instead of tracing. (fuel-core/bin/fuel-core/src/cli/run.rs#47–51)
use tracing::{
info,
log::warn,
trace,};
The wrong import is used in the following figure to print a warning.
Figure 21.2: Usage of wrong import. (fuel-core/bin/fuel-core/src/cli/run.rs#260–262)
if consensus_key.is_some() && trigger == Trigger::Never{warn!("Consensus key configured but block production is disabled!")}
Exploit Scenario
An attacker controls the configuration and is able to enable debugging options. Because relevant warnings during startup are not logged it is not possible to audit the node.
Recommendations
Short term, make sure that the log facade is not used.
Long term, enforce that the log facade is not used by using a clippy lint. Alternatively, configure the log facade to output messages to the terminal as well. The formatting of these messages could indicate an additional warning that the wrong facade is used.
The text was updated successfully, but these errors were encountered:
Description
The fuel-core node imports logging macros (like info!, warn!, or error!) from the log facade instead from the tracing. Messages logged through the log facade do not get printed to the terminal and get ignored silently. Both facades are provided by the respective dependencies tracing and log.
The following code highlights a wrong import.
Figure 21.1: Import from the log facade instead of tracing. (fuel-core/bin/fuel-core/src/cli/run.rs#47–51)
The wrong import is used in the following figure to print a warning.
Figure 21.2: Usage of wrong import. (fuel-core/bin/fuel-core/src/cli/run.rs#260–262)
Exploit Scenario
An attacker controls the configuration and is able to enable debugging options. Because relevant warnings during startup are not logged it is not possible to audit the node.
Recommendations
Short term, make sure that the log facade is not used.
Long term, enforce that the log facade is not used by using a clippy lint. Alternatively, configure the log facade to output messages to the terminal as well. The formatting of these messages could indicate an additional warning that the wrong facade is used.
The text was updated successfully, but these errors were encountered: