[GODRIVER-1086] Can leak creds through errors from URI Parsing Created: 22/May/19 Updated: 28/Oct/23 Resolved: 24/May/19 |
|
| Status: | Closed |
| Project: | Go Driver |
| Component/s: | Error Handling |
| Affects Version/s: | 1.0.2 |
| Fix Version/s: | 1.0.3 |
| Type: | Bug | Priority: | Critical - P2 |
| Reporter: | Scott L'Hommedieu (Inactive) | Assignee: | Isabella Siu (Inactive) |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | security | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Issue Links: |
|
||||||||||||||||
| Description |
|
When a URI Parsing error is encountered the return is the URI (conn string) and the parse error. The error contains, in the message, the URI passed to the parse function. Downstream consumers of the driver do not necessarily have that implementation detail and may pass the error on further downstream. Since the URI may contain sensitive information (passwords) these errors may inadvertently leak credentials. |
| Comments |
| Comment by Githook User [ 24/May/19 ] |
|
Author: {'name': 'iwysiu', 'email': 'isabella.siu@10gen.com', 'username': 'iwysiu'}Message: Change-Id: Ia7ce0035da57defa49359cb1c134d32507505210 |
| Comment by Githook User [ 24/May/19 ] |
|
Author: {'name': 'iwysiu', 'email': 'isabella.siu@10gen.com', 'username': 'iwysiu'}Message: Change-Id: Ia7ce0035da57defa49359cb1c134d32507505210 |
| Comment by Isabella Siu (Inactive) [ 24/May/19 ] |
|
code review url: https://review.gerrithub.io/c/mongodb/mongo-go-driver/+/455680 |
| Comment by Ian Whalen (Inactive) [ 23/May/19 ] |
|
audit for any other leaks of the uri string in error messages. |
| Comment by Jeffrey Yemin [ 23/May/19 ] |
|
Note: because the URI parsing process of a mongodb+srv URI involves looking up a TXT record in DNS, a perfectly fine URI from a syntax perspective can result in an error if the DNS lookup fails. |