redis/ioredis

Errors contain credentials in plaintext

Open

#1,713 opened on Jan 27, 2023

View on GitHub
 (4 comments) (4 reactions) (0 assignees)TypeScript (1,069 forks)batch import
help wanted

Repository metrics

Stars
 (12,302 stars)
PR merge metrics
 (Avg merge 3d 5h) (5 merged PRs in 30d)

Description

When wrong credentials are provided to Redis, this gets logged:

{"level":50,"time":1674832773627,"pid":1,"hostname":"service-79d5f6fb77-gf4ks","type":"ReplyError","message":"WRONGPASS invalid username-password pair or user is disabled.","stack":"ReplyError: WRONGPASS invalid username-password pair or user is disabled.\n    at parseError (/app/node_modules/redis-parser/lib/parser.js:179:12)\n    at parseType (/app/node_modules/redis-parser/lib/parser.js:302:14)","command":{"name":"auth","args":["APPLICATION_USERNAME","APPLICATION_PASSWORD"]}}

APPLICATION_USERNAME and APPLICATION_PASSWORD should not be there.

Contributor guide

Research direction
Investigate how the Redis client logs authentication errors and modify the code to redact credentials from the logged command arguments.
Tech stack
typescriptnodejs
Domain
backend
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GitNode.js
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60