Mask auth-key when logging connection exceptions

Fixes #90
apa512 · Nov 19, 2015 · d994035 · d994035
1 parent e5838b1
commit d994035
Show file tree

Hide file tree

Showing 4 changed files with 41 additions and 27 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -8,6 +8,7 @@ All notable changes to this project will be documented in this file. This change
 - Added a new arity to `changes` that allows you to pass optargs. [#112](https://github.com/apa512/clj-rethinkdb/issues/112)
 - Renamed changes arg from `table` to `xs`. [#76](https://github.com/apa512/clj-rethinkdb/issues/76)
 - Prefix RethinkDB server exceptions with `RethinkDB server:`. [#100](https://github.com/apa512/clj-rethinkdb/pull/100)
+- Mask auth-key when logging connection exceptions [#90](https://github.com/apa512/clj-rethinkdb/issues/90)
 
 
 ## [0.11.0] - 2015-10-19

diff --git a/src/rethinkdb/core.clj b/src/rethinkdb/core.clj
@@ -70,30 +70,32 @@
            token 0
            auth-key ""
            db nil}}]
-  (try
-    (let [socket (Socket. host port)
-          out (DataOutputStream. (.getOutputStream socket))
-          in (DataInputStream. (.getInputStream socket))]
-      ;; Disable Nagle's algorithm on the socket
-      (.setTcpNoDelay socket true)
-      ;; Initialise the connection
-      (send-version out)
-      (send-auth-key out auth-key)
-      (send-protocol out)
-      (let [init-response (read-init-response in)]
-        (log/trace "Initial response while establishing RethinkDB connection:" init-response)
-        (when-not (= init-response "SUCCESS")
-          (throw (ex-info init-response {:host host :port port :auth-key auth-key :db db}))))
-      ;; Once initialised, create the connection record
-      (connection
-        (merge
-          {:socket socket
-           :out out
-           :in in
-           :db db
-           :waiting #{}
-           :token token}
-          (make-connection-loops in out))))
-    (catch Exception e
-      (log/error e "Error connecting to RethinkDB database")
-      (throw (ex-info "Error connecting to RethinkDB database" {:host host :port port :auth-key auth-key :db db} e)))))
+  (let [auth-key-printable (if (= "" auth-key) "" "<auth key provided but hidden>")]
+    (try
+      (let [socket (Socket. host port)
+            out (DataOutputStream. (.getOutputStream socket))
+            in (DataInputStream. (.getInputStream socket))]
+        ;; Disable Nagle's algorithm on the socket
+        (.setTcpNoDelay socket true)
+        ;; Initialise the connection
+        (send-version out)
+        (send-auth-key out auth-key)
+        (send-protocol out)
+        (let [init-response (read-init-response in)]
+          (log/trace "Initial response while establishing RethinkDB connection:" init-response)
+          (when-not (= init-response "SUCCESS")
+            (throw (ex-info init-response {:host host :port port :auth-key auth-key-printable :db db}))))
+        ;; Once initialised, create the connection record
+        (connection
+          (merge
+            {:socket  socket
+             :out     out
+             :in      in
+             :db      db
+             :waiting #{}
+             :token   token}
+            (make-connection-loops in out))))
+      (catch Exception e
+        (log/error e "Error connecting to RethinkDB database")
+        (throw (ex-info "Error connecting to RethinkDB database"
+                        {:host host :port port :auth-key auth-key-printable :db db} e))))))
diff --git a/test-resources/large-response.json b/test-resources/large-response.json
diff --git a/test/rethinkdb/core_test.clj b/test/rethinkdb/core_test.clj
@@ -377,5 +377,15 @@
   (with-redefs-fn {#'core/send-version (fn [out] (net/send-int out 168696 4))}
     #(is (thrown? ExceptionInfo (r/connect)))))
 
+(deftest dont-leak-auth-key
+  (try (r/connect :port 28016 :auth-key "super secret")
+       (catch ExceptionInfo e
+         (is (= "<auth key provided but hidden>"
+                (:auth-key (ex-data e))))))
+  (try (r/connect :port 28016)
+       (catch ExceptionInfo e
+         (is (= ""
+                (:auth-key (ex-data e)))))))
+
 (use-fixtures :each setup-each)
 (use-fixtures :once setup-once)