SecurIty: Credentials are leaked on the log file

[mancausoft]

In the logs i can see: mongoclient {"connectionUrl":"mongodb://root:[email protected]:27017/?authSource=admin&connectTimeoutMS=3000&socketTimeoutMS=5000&authMechanism=SCRAM-SHA-1","options":{"useNewUrlParser":true,"useUnifiedTopology":true,"authSource":"admin"},"sessionId":"hXib56nsdweGeKC","level":"debug","message":"[connect]"}

Expected Behavior

Never log password

Current Behavior

The password is written in plain on the logs

Possible Solution

Replace password with some other char

Steps to Reproduce (for bugs)

Connect to a DB from the UI interface.

Your Environment

• Nosqlclient version used: "mongoclient/mongoclient@sha256:ca98c95de349493fab630ca3fae6e611e27e392ebc59f14d7dd73580c045927a"

• Environment name: docker

[rsercano]

Hi @mancausoft I'm surprised nosqlclient is still being used :) I cant find time to keep developing nosqlclient any further.

Yet this one is a resolved issue, you can set MONGOCLIENT_LOG_LEVEL env variable to info and you won't see debug logs anymore.

[mancausoft]

@rsercano The Log level was already set to INFO

[rsercano]

@rsercano The Log level was already set to INFO

Strange that the log you sent is a debug log actually, could you please send me a screenshot of your docker info command?