Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove more credentials from stack trace. #8083

Merged
merged 1 commit into from
May 17, 2022
Merged

Remove more credentials from stack trace. #8083

merged 1 commit into from
May 17, 2022

Conversation

driusan
Copy link
Collaborator

@driusan driusan commented Apr 13, 2022

#8074 removed username/password related arguments from the database singleton call, but not the connect call.

This removes them from select too, so there's nothing vulnerable in the stack trace.

@driusan driusan added the Security PR patches a vulnerability, makes resource access changes, or updates dependencies label Apr 13, 2022
@driusan
Copy link
Collaborator Author

driusan commented May 11, 2022

@kongtiaowang can you review/test this?

kongtiaowang
kongtiaowang approved these changes May 17, 2022
View reviewed changes
Copy link
Contributor

@kongtiaowang kongtiaowang left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@driusan driusan merged commit b8d5a8a into aces:main May 17, 2022
@ridz1208 ridz1208 added this to the 25.0.0 milestone May 17, 2022
driusan added a commit to driusan/Loris that referenced this pull request Oct 6, 2022
@driusan
[instrument_manager] Fix page load
9862ce1 
The function signature for Database->connect was updated in aces#8083,
but a call in the instrument_manager was missed.

This updates the call to pass the credentials with the new signature
which doesn't include username/password in the stack trace.
@driusan driusan mentioned this pull request Oct 6, 2022
Merged
driusan added a commit that referenced this pull request Oct 6, 2022
@driusan
[instrument_manager] Fix page load (#8183)
fa56a6a 
The function signature for Database->connect was updated in #8083,
but a call in the instrument_manager was missed.

This updates the call to pass the credentials with the new signature
which doesn't include username/password in the stack trace.

Resolves #8182
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kongtiaowang kongtiaowang kongtiaowang approved these changes

Assignees
No one assigned
Labels
Security PR patches a vulnerability, makes resource access changes, or updates dependencies
Projects
None yet
Milestone
24.1.0
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@driusan @kongtiaowang @ridz1208