mongo4idea
mongo4idea copied to clipboard
Plugin leaks Mongo password to IntelliJ logs
I've noticed the plugin will sometimes leak the full mongo
command, including the auth password, to the IDE's event log. This shouldn't happen; when logging commands like that, please make sure the password is at least redacted, or better do not log commands.
A simple initial solution would be to replace all occurrences of the password in logged messages with another string, like <redacted>
.