redis/ioredis

Errors contain credentials in plaintext

クローズ

#1,713 opened on 2023/01/27

 (5 件のコメント) (4 件のリアクション) (0 人の担当者)TypeScript (1,069 件のフォーク)batch import
help wantedstale

Repository metrics

Stars
 (12,302 個のスター)
PR merge metrics
 (PR metrics pending)

説明

When wrong credentials are provided to Redis, this gets logged:

{"level":50,"time":1674832773627,"pid":1,"hostname":"service-79d5f6fb77-gf4ks","type":"ReplyError","message":"WRONGPASS invalid username-password pair or user is disabled.","stack":"ReplyError: WRONGPASS invalid username-password pair or user is disabled.\n    at parseError (/app/node_modules/redis-parser/lib/parser.js:179:12)\n    at parseType (/app/node_modules/redis-parser/lib/parser.js:302:14)","command":{"name":"auth","args":["APPLICATION_USERNAME","APPLICATION_PASSWORD"]}}

APPLICATION_USERNAME and APPLICATION_PASSWORD should not be there.

コントリビューターガイド