Skip to content

Commit

Permalink
[AMQP] [Messenger] Do not leak any credentials when connection fails
Browse files Browse the repository at this point in the history
I noticed that when the connection to AMQP fails for whatever reason all the DSK credentials are leaked.

Yes, the password is masked. But it still leaks the server, port and username.

I think these things should be private and not be logged to a logger server or error capture service.
  • Loading branch information
ruudk authored and fabpot committed Aug 25, 2021
1 parent 7444d23 commit 7bf38ef
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 7 deletions.
4 changes: 2 additions & 2 deletions Tests/Transport/ConnectionTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -559,10 +559,10 @@ public function testItDelaysTheMessageWithADifferentRoutingKeyAndTTLs()
$connection->publish('{}', [], 120000);
}

public function testObfuscatePasswordInDsn()
public function testNoCredentialLeakageWhenConnectionFails()
{
$this->expectException(\AMQPException::class);
$this->expectExceptionMessage('Could not connect to the AMQP server. Please verify the provided DSN. ({"host":"localhost","port":5672,"vhost":"/","login":"user","password":"********"})');
$this->expectExceptionMessage('Could not connect to the AMQP server. Please verify the provided DSN.');
$factory = new TestAmqpFactory(
$amqpConnection = $this->createMock(\AMQPConnection::class),
$amqpChannel = $this->createMock(\AMQPChannel::class),
Expand Down
6 changes: 1 addition & 5 deletions Transport/Connection.php
Original file line number Diff line number Diff line change
Expand Up @@ -495,11 +495,7 @@ public function channel(): \AMQPChannel
try {
$connection->{$connectMethod}();
} catch (\AMQPConnectionException $e) {
$credentials = $this->connectionOptions;
$credentials['password'] = '********';
unset($credentials['delay']);

throw new \AMQPException(sprintf('Could not connect to the AMQP server. Please verify the provided DSN. (%s).', json_encode($credentials, \JSON_UNESCAPED_SLASHES)), 0, $e);
throw new \AMQPException('Could not connect to the AMQP server. Please verify the provided DSN.', 0, $e);
}
$this->amqpChannel = $this->amqpFactory->createChannel($connection);

Expand Down

0 comments on commit 7bf38ef

Please sign in to comment.