Redact secrets when logging config and warn user when changing categories

pyproject.toml

@@ -52,6 +52,7 @@ dependencies = [
 	"mdx-gh-links==0.4",
 	"l2m4m==1.0.4",
 	"pymdown-extensions==10.17.1",
+	"detect-secrets==1.5.0",
 ]
 
 [project.urls]

source/config/__init__.py

@@ -604,7 +604,7 @@ def _loadConfig(self, fn, fileError=False):
 			profileUpgrader.upgrade(profile, self.validator, writeProfileFunc)
 		except Exception as e:
 			# Log at level info to ensure that the profile is logged.
-			log.info("Config before schema update:\n%s" % profileCopy, exc_info=False)
+			log.info("Config before schema update:\n%s" % profileCopy, exc_info=False, redactSecrets=True)
 			raise e
 		# since profile settings are not yet imported we have to "peek" to see
 		# if debug level logging is enabled.
@@ -618,6 +618,7 @@ def _loadConfig(self, fn, fileError=False):
 				"Config loaded (after upgrade, and in the state it will be used by NVDA):\n{0}".format(
 					profile,
 				),
+				redactSecrets=True,
 			)
 		return profile
 

source/logHandler.py

@@ -233,15 +233,30 @@ class Logger(logging.Logger):
 
 	def _log(
 		self,
-		level,
-		msg,
+		level: int,
+		msg: str,
 		args,
-		exc_info=None,
-		extra=None,
-		codepath=None,
-		activateLogViewer=False,
-		stack_info=None,
+		exc_info: _excInfo_t | Literal[True] | BaseException = None,
+		extra: dict | None = None,
+		codepath: str | None = None,
+		activateLogViewer: bool = False,
+		stack_info: list[traceback.FrameSummary] | bool | None = None,
+		redactSecrets: bool = False,
 	):
+		"""Logs a message with the given severity level.
+
+		:param level: The severity level of the log message.
+		:param msg: The log message, which may contain format specifiers that will be replaced by the values in `args`.
+		:param args: The arguments to be merged into `msg` using the `%` operator for string formatting.
+		:param exc_info: Exception information to be logged, defaults to None
+		:param extra: Additional information to be logged, defaults to None
+		:param codepath: The code path where the log was generated, defaults to None
+		:param activateLogViewer: Whether to activate the log viewer, defaults to False
+		:param stack_info: Stack information to be logged, defaults to None
+		:param redactSecrets: Whether to check for and redact secrets in the log message, defaults to False
+		:return: The result of the logging operation
+		"""
+
 		if not extra:
 			extra = {}
 
@@ -273,6 +288,12 @@ def _log(
 				"".join(traceback.format_list(stack_info)).rstrip(),
 			)
 
+		if redactSecrets:
+			from detect_secrets.core.scan import scan_line
+
+			for secret in scan_line(msg: str):
+				msg.replace(secret.secret_value, "****")
+
 		res = super()._log(level, msg, args, exc_info, extra)
 
 		if activateLogViewer: