init-db logs the full Postgres connection URL including the password

Open Beginner friendly
#70 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
88/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
javascript, postgres

Research direction

Start in bin/init-db.js at the “ensuring database exists” log site and inspect how the resolved PostgreSQL URL is assembled for logging. Verify the resulting startup log retains useful host or database information without exposing credentials, and check the mentioned worker/server startup paths for consistency.

Written by the indexing model from the issue text.

Description

What happens

bin/init-db.js logs the resolved connection string verbatim at startup:

{"level":30,...,"module":"init-db","database":"keryx","postgresUrl":"postgres://user:<url-encoded-password>@host:5432/db?ssl=true","msg":"ensuring database exists"}

Deployments that run init-db as an initContainer (as recommended for the 0.7.0 DDL) ship this line — password included — to whatever log pipeline scrapes pod stdout (Loki/CloudWatch/Datadog/...). We hit this today on our staging rollout of 0.7.0: the database password is now sitting in our log store and has to be rotated.

Expected

Redact credentials before logging, e.g. log url.host + url.pathname only, or replace the password component with ***:

const safe = new URL(postgresUrl); safe.password = safe.password ? '***' : '';
log.info({ postgresUrl: safe.toString(), database }, 'ensuring database exists')

Same consideration applies anywhere else a connection URL is logged (worker/server startup paths log host-only today, which is good — init-db is the outlier).

Version

@y/hub 0.7.0 (bin/init-db.js, the ensuring database exists log site).

Dominant language
JavaScript
Stars
301
Forks
58
Avg merge
28m
Merged PRs (30d)
1

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from yjs/yhub

All issues in yjs/yhub

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.