Remove disclosure of invalid credentials and sensitive values via errors which leverage JSON.stringify

XMLWordPrintableJSON

    • Type: Improvement
    • Resolution: Unresolved
    • Priority: Minor - P4
    • None
    • Affects Version/s: None
    • Component/s: None
    • None
    • Hide

      1. What would you like to communicate to the user about this feature?
      2. Would you like the user to see examples of the syntax and/or executable code and its output?
      3. Which versions of the driver/connector does this apply to?

      Show
      1. What would you like to communicate to the user about this feature? 2. Would you like the user to see examples of the syntax and/or executable code and its output? 3. Which versions of the driver/connector does this apply to?
    • None
    • None
    • None
    • None
    • None
    • None

      Use Case

      As a user of mongodb node team driver repos
      I want to ensure that potentially-sensitive user-supplied values arent revealed in errors or logs
      So that sensitive information disclosure does not take place

      User Experience

      • User supplied values should not be present in error messages as they could contain sensitive values

      Dependencies

      • N/A

      Risks/Unknowns

      • Should we only scope-in values which we think can contain user-supplied values, or omit them completely from errors?
      • Some upstream calls which yield errors with user-supplied values in them could be relied on by users, causing a breaking change to be introduced.

      Acceptance Criteria

      Implementation Requirements

      • All repo's which surface user input into logs/errors should redact the user input (e.g: an invalid connstr should not be embedded in an error, potentially revealing the password supplied) (use a subtask per repo)

      Testing Requirements

      • unit test, spec test sync, etc

      Documentation Requirements

      • DOCSP ticket, API docs, etc

      Follow Up Requirements

      • N/A

      See: https://jira.mongodb.org/browse/ENGSEC-675 for more information

        1.
        		 Avoid usage of JSON.stringify when returning user input NODE-7663 Sub-task Closed Unassigned  
        2.
        		 Do not disclosure connection string on error NODE-7665 Sub-task Closed Johnathan Martell mongodb-connection-string-url-7.0.2

            Assignee:
            Unassigned
            Reporter:
            Johnathan Martell
            None
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: