Saved database passwords collide across SSH connections using identical localhost endpoints
還沒有人認領這個 Issue。
評估
- 難度
- 4/5
- 預估耗時
- 3-5 天
- 新手友好度
- 48/100
- Issue 類型
- 缺陷
- 描述清晰度
- 描述清楚
- 活躍度
- 活躍
- 技術堆疊
- postgresql, vscode
研究方向
Start by tracing how connection profiles save and retrieve database passwords through VS Code SecretStorage, especially how the credential key is derived from profile and endpoint properties. Compare two profiles with identical database properties but different SSH destinations, then verify each reconnect retrieves its own password; done means saving either profile no longer overwrites the other's credential.
由索引模型根據 Issue 內容生成。
描述
Describe the bug
Separate native-SSH connection profiles overwrite each other's saved PostgreSQL
passwords when their database endpoint properties match, despite different
profile IDs and SSH destinations.
Affected extension: ms-ossdata.vscode-pgsql version 1.32.1, running in a
Linux/WSL extension host. The exact VS Code editor version was not captured.
This is distinct from the expected migration of plaintext settings passwords
into VS Code SecretStorage: the migrated credentials collide.
To Reproduce
- Configure two native-SSH profiles with these properties:
| Property | Profile A | Profile B |
|---|---|---|
id |
example-profile-a |
example-profile-b |
server |
localhost |
localhost |
port |
5432 |
5432 |
database |
example_db |
example_db |
user |
example_user |
example_user |
authenticationType |
SqlLogin |
SqlLogin |
password |
dummy-password-a |
dummy-password-b |
savePassword |
true |
true |
sshEnabled |
true |
true |
sshHost |
jump-a.invalid |
jump-b.invalid |
sshPort |
22 |
22 |
sshUsername |
example_ssh_user |
example_ssh_user |
sshAuthenticationType |
publicKey |
publicKey |
Use valid test private-key paths for sshKeyfile. The test databases should
require their respective different dummy passwords.
- Allow the extension to save/migrate both database passwords.
- Reconnect to both profiles. One can receive the other profile's saved
password and fail database authentication despite a successful SSH tunnel.
Expected behavior
Profiles targeting different SSH destinations should retrieve their own saved
database passwords. Saving one must not overwrite the credential of another.
VS Code version
Windows 1.144.0
- 主要語言
- 沒有語言資料
- 星號
- 406
- 分支
- 35
- 平均合併
- 2 小時 47 分鐘
- 30 天內合併 PR
- 5
環境準備
這個專案沒有提供開發容器、Dockerfile 或貢獻指南，環境需要你自己搭建：先看它的 README，通用步驟見我們的新手貢獻指南。
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
microsoft/vscode-pgsql 的其他 Issue
-
難度 2/5 1-3 小時 新手友好度 62/100
microsoft/vscode-pgsql#314 · 1 則留言 ·
-
enhancement
難度 2/5 1-3 小時 新手友好度 68/100
microsoft/vscode-pgsql#190 · 3 則留言 ·
-
難度 4/5 3-5 天 新手友好度 48/100
microsoft/vscode-pgsql#323 · 2 則留言 ·
-
難度 4/5 3-5 天 新手友好度 25/100
microsoft/vscode-pgsql#319 ·
-
難度 4/5 1-2 天 新手友好度 25/100
microsoft/vscode-pgsql#318 · 1 則留言 ·
查看 microsoft/vscode-pgsql 的全部 Issue
相似的 Issue
-
enhancement security severity:low
難度 2/5 1-3 小時 新手友好度 83/100
Battle-Cattle/BCUK-Bot-4#959 ·
維護者通常 1 天內回覆
-
serve --http: push webhook signature check still differs in timing between unknown and signed repos未關閉
難度 2/5 1-3 小時 新手友好度 68/100
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 76/100
auth0/auth0-flutter#991 ·
維護者通常 1 天內回覆
-
security trivy
難度 2/5 1-3 小時 新手友好度 72/100
kubefleet-dev/kubefleet#1037 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 65/100
swc-project/swc-ai-issues#59 ·