redis/ioredis

Errors contain credentials in plaintext

Chiusa

#1713 aperta il 27 gen 2023

 (5 commenti) (4 reazioni) (0 assegnatari)TypeScript (1069 fork)batch import
help wantedstale

Metriche repository

Star
 (12.302 stelle)
Metriche merge PR
 (Metriche PR in attesa)

Descrizione

When wrong credentials are provided to Redis, this gets logged:

{"level":50,"time":1674832773627,"pid":1,"hostname":"service-79d5f6fb77-gf4ks","type":"ReplyError","message":"WRONGPASS invalid username-password pair or user is disabled.","stack":"ReplyError: WRONGPASS invalid username-password pair or user is disabled.\n    at parseError (/app/node_modules/redis-parser/lib/parser.js:179:12)\n    at parseType (/app/node_modules/redis-parser/lib/parser.js:302:14)","command":{"name":"auth","args":["APPLICATION_USERNAME","APPLICATION_PASSWORD"]}}

APPLICATION_USERNAME and APPLICATION_PASSWORD should not be there.

Guida contributor