Redact passwords provided in URL when passing errors to callbacks

[alxndrsn]

Fixes balderdashy/sails#4595

[rachaelshaw]

@alxndrsn before I merge this in, would you take one more look to and see if there's another property that could be used to uniquely identify the type of error that's leaking these credentials? (Since using a regular expression for this has the potential for false positives, it'd be good to see if there's another way before resorting to that.)

[alxndrsn]

@rachaelshaw I understand and share your hesitation - this is hardly pretty code. OTOH I've found it very hard to trace through exactly where these errors are generated, and at this level it would be hard to match which errors are affected (at least at this level), as it seems that:

1. all errors generated in the database adapter will include the meta section from the sails config
2. regex 1 is unlikely to have false-positives
3. (all?) errors containing structured info (including .meta) are converted into strings at some lower level than this plugin, hence the match-all nature of the second regex. This isn't great, and I can't recall exactly where it happens (perhaps in machine itself?).

Perhaps a lower-level fix would happen in machinepack-postrgresql, as this appears to be where the meta object is attached to every error. At this point, the regex could be applied directly to the meta.url value, or perhaps other included values (is there also an option to specify username and password separately? https://sailsjs.com/documentation/concepts/extending-sails/adapters/available-adapters implies not.)

[alxndrsn]

@rachaelshaw any more thoughts on this?

[Noitidart]

False positives is much better than leaving this out there. I would say merge this.

[alxndrsn]

I think this can be simplified to:

if(typeof err.meta === 'object' && typeof err.meta.url === 'string') {

[alxndrsn]

As above, I think the initial check can be removed, so this line would just be:

if(typeof err.message === 'string') {

[johnabrams7]

@alxndrsn Sorry for the delay, after fully testing the new code, I was able to successfully hide/censor the PostgreSQL database passwords with asterisks. Merging this in, thanks again!

[alxndrsn]

@johnabrams7 thanks for the merge. Any idea when this might get a public release?

[Noitidart]

Has this been publically released?