Language: Python
Label: vulnerable
CWE: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Code:
def process_instance_metadata(metadata, key_path="", sensitive_keys=()):
    """Process all instance metadata cleaning it up for persisting as json.

    Strip ci-b64 prefix and catalog any 'base64_encoded_keys' as a list

    @return Dict copy of processed metadata.
    """
    md_copy = copy.deepcopy(metadata)
    base64_encoded_keys = []
    sens_keys = []
    for key, val in metadata.items():
        if key_path:
            sub_key_path = key_path + "/" + key
        else:
            sub_key_path = key
        if key in sensitive_keys or sub_key_path in sensitive_keys:
            sens_keys.append(sub_key_path)
        if isinstance(val, str) and val.startswith("ci-b64:"):
            base64_encoded_keys.append(sub_key_path)
            md_copy[key] = val.replace("ci-b64:", "")
        if isinstance(val, dict):
            return_val = process_instance_metadata(
                val, sub_key_path, sensitive_keys
            )
            base64_encoded_keys.extend(return_val.pop("base64_encoded_keys"))
            sens_keys.extend(return_val.pop("sensitive_keys"))
            md_copy[key] = return_val
    md_copy["base64_encoded_keys"] = sorted(base64_encoded_keys)
    md_copy["sensitive_keys"] = sorted(sens_keys)
    return md_copy