redis/ioredis

Errors contain credentials in plaintext

Open

#1713 aperta il 27 gen 2023

Vedi su GitHub
 (4 commenti) (4 reazioni) (0 assegnatari)TypeScript (1069 fork)batch import
help wanted

Metriche repository

Star
 (12.302 star)
Metriche merge PR
 (Merge medio 3g 5h) (5 PR mergiate in 30 g)

Descrizione

When wrong credentials are provided to Redis, this gets logged:

{"level":50,"time":1674832773627,"pid":1,"hostname":"service-79d5f6fb77-gf4ks","type":"ReplyError","message":"WRONGPASS invalid username-password pair or user is disabled.","stack":"ReplyError: WRONGPASS invalid username-password pair or user is disabled.\n    at parseError (/app/node_modules/redis-parser/lib/parser.js:179:12)\n    at parseType (/app/node_modules/redis-parser/lib/parser.js:302:14)","command":{"name":"auth","args":["APPLICATION_USERNAME","APPLICATION_PASSWORD"]}}

APPLICATION_USERNAME and APPLICATION_PASSWORD should not be there.

Guida contributor