redis/ioredis

Errors contain credentials in plaintext

Open

#1713 opened on Jan 27, 2023

View on GitHub
 (4 comments) (4 reactions) (0 assignees)TypeScript (12,302 stars) (1,069 forks)batch import
help wanted

Description

When wrong credentials are provided to Redis, this gets logged:

{"level":50,"time":1674832773627,"pid":1,"hostname":"service-79d5f6fb77-gf4ks","type":"ReplyError","message":"WRONGPASS invalid username-password pair or user is disabled.","stack":"ReplyError: WRONGPASS invalid username-password pair or user is disabled.\n    at parseError (/app/node_modules/redis-parser/lib/parser.js:179:12)\n    at parseType (/app/node_modules/redis-parser/lib/parser.js:302:14)","command":{"name":"auth","args":["APPLICATION_USERNAME","APPLICATION_PASSWORD"]}}

APPLICATION_USERNAME and APPLICATION_PASSWORD should not be there.

Contributor guide

Tech stack
typescriptnodejs
Domain
backendsecurity
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Node.js basicsRedis authenticationUnderstanding of logging
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60
Research direction
The issue is that the Redis error message includes the credentials in plaintext when authentication fails. The fix involves modifying the error handling in the ioredis library to redact or omit the username and password from the logged command arguments. Look at the 'auth' command implementation in the source code (likely in the 'command' or 'redis' modules). Ensure that any logging of command arguments masks sensitive fields. Consider adding a redaction mechanism similar to what other libraries use. The maintainers may provide guidance in the issue comments.