Language server logs full Terraform source for every didOpen and didChange notification

[chernetskyi]

Summary

tflint --langserver logs the complete parameters of every LSP request and notification to stderr, including the full document text from textDocument/didOpen and textDocument/didChange.

Because the server uses full document synchronization, every edit logs the entire Terraform file. This creates significant log volume and may expose credentials or other sensitive configuration in editor logs.

Reproduced with Neovim 0.12.5 without enabling TFLINT_LOG.

Steps:

1. Start TFLint as a language server.
2. Open the configuration below.
3. Edit the string value.
4. Inspect the language server's stderr output.

Expected: document contents are omitted or only logged when explicit debug/trace logging is enabled.

Actual: the complete document is logged after every edit.

Related to the general LSP umbrella issue #1356, but that issue does not mention logging.

Command

tflint --langserver

Terraform Configuration

locals {
  api_token = "example-sensitive-value"
}

TFLint Configuration

TFLint defaults

Output

handler.go:117: Received textDocument/didChange with {"contentChanges":[{"text":"locals {\n  api_token = \"example-sensitive-value\"\n}\n"}],"textDocument":{"uri":"file:///tmp/tflint-lsp-repro/main.tf","version":2}}

TFLint Version

0.61.0

Terraform Version

1.16.0

Operating System

• Linux
• macOS
• Windows