[
https://issues.apache.org/jira/browse/COUCHDB-2949?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15147795#comment-15147795
]
ASF subversion and git services commented on COUCHDB-2949:
----------------------------------------------------------
Commit fd66cb6b3dc70a64b556bb1e5bd9fa05f20df571 in couchdb-couch-replicator's
branch refs/heads/master from [~mikewallace]
[
https://git-wip-us.apache.org/repos/asf?p=couchdb-couch-replicator.git;h=fd66cb6
]
Avoid logging creds on couch_replicator termination
When couch_replicator terminates with an error we log the #rep
record which can contain credentials for the source or target
of a replication, either in the url directly or in an Authorization
header.
This commit adds a function to strip credentials from the #httpdb
records in the #rep record and replace them with ****.
Specifically this concerns the url and headers fields of the
#rep.source and #rep.target #httpdb records.
We also add the format_status/2 callback and strip creds from the
#rep_state record in the gen_server state to prevent the creds
in the state getting logged in the event of a crash.
Closes COUCHDB-2949
This closes #25
> Replications which fail to start dump creds into the logs
> ---------------------------------------------------------
>
> Key: COUCHDB-2949
> URL: https://issues.apache.org/jira/browse/COUCHDB-2949
> Project: CouchDB
> Issue Type: Bug
> Components: Replication
> Reporter: Mike Wallace
>
> If a replication fails to start then the `#rep` record is logged [1]. This
> can contain credentials in either the source or target `#httpdb` records,
> either in urls or the authorization header.
> This can be reproduced by posting a replication document which specifies a
> replication from a database that doesn't exist and following the logs, e.g.:
> https://gist.github.com/mikewallace1979/757a48bce6b84fbf080c
> Note that the creds are exposed both when they are in the source/target url
> or in the `Authorization` header.
> [1]
> https://github.com/apache/couchdb-couch-replicator/blob/master/src/couch_replicator.erl#L519-L520
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
