mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-08-03 18:38:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Refs #32061 -- Prevented password leak on MySQL dbshell crash.

Browse source 
The usage of the --password flag when invoking the mysql CLI has the
potential of exposing the password in plain text if the command happens
to crash due to the inclusion of args provided to
subprocess.run(check=True) in the string representation of the
subprocess.CalledProcessError exception raised on non-zero return code.

Since this has the potential of leaking the password to logging
facilities configured to capture crashes (e.g. sys.excepthook, Sentry)
it's safer to rely on the MYSQL_PWD environment variable instead even
if its usage is discouraged due to potential leak through the ps
command on old flavors of Unix.

Thanks Charlie Denton for reporting the issue to the security team.

Refs #24999.
This commit is contained in:
Simon Charette 2020-10-04 18:31:04 -04:00 • committed by Mariusz Felisiak
parent eb25fdb620
commit 384ac0990f
2 changed files with 40 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

42
tests/dbshell/test_mysql.py
View file

@ -1,3 +1,7 @@
import subprocess
import sys
from pathlib import Path
from django.db.backends.mysql.client import DatabaseClient
from django.test import SimpleTestCase
@ -16,12 +20,11 @@ class MySqlDbshellCommandTestCase(SimpleTestCase):
expected_args = [
'mysql',
'--user=someuser',
'--password=somepassword',
'--host=somehost',
'--port=444',
'somedbname',
]
expected_env = None
expected_env = {'MYSQL_PWD': 'somepassword'}
self.assertEqual(
self.settings_to_cmd_args_env({
'NAME': 'somedbname',
@ -41,12 +44,11 @@ class MySqlDbshellCommandTestCase(SimpleTestCase):
expected_args = [
'mysql',
'--user=optionuser',
'--password=optionpassword',
'--host=optionhost',
'--port=%s' % options_port,
'optiondbname',
]
expected_env = None
expected_env = {'MYSQL_PWD': 'optionpassword'}
self.assertEqual(
self.settings_to_cmd_args_env({
'NAME': 'settingdbname',
@ -69,12 +71,11 @@ class MySqlDbshellCommandTestCase(SimpleTestCase):
expected_args = [
'mysql',
'--user=someuser',
'--password=optionpassword',
'--host=somehost',
'--port=444',
'somedbname',
]
expected_env = None
expected_env = {'MYSQL_PWD': 'optionpassword'}
self.assertEqual(
self.settings_to_cmd_args_env({
'NAME': 'somedbname',
@ -91,13 +92,12 @@ class MySqlDbshellCommandTestCase(SimpleTestCase):
expected_args = [
'mysql',
'--user=someuser',
'--password=somepassword',
'--host=somehost',
'--port=444',
'--default-character-set=utf8',
'somedbname',
]
expected_env = None
expected_env = {'MYSQL_PWD': 'somepassword'}
self.assertEqual(
self.settings_to_cmd_args_env({
'NAME': 'somedbname',
@ -114,11 +114,10 @@ class MySqlDbshellCommandTestCase(SimpleTestCase):
expected_args = [
'mysql',
'--user=someuser',
'--password=somepassword',
'--socket=/path/to/mysql.socket.file',
'somedbname',
]
expected_env = None
expected_env = {'MYSQL_PWD': 'somepassword'}
self.assertEqual(
self.settings_to_cmd_args_env({
'NAME': 'somedbname',
@ -135,7 +134,6 @@ class MySqlDbshellCommandTestCase(SimpleTestCase):
expected_args = [
'mysql',
'--user=someuser',
'--password=somepassword',
'--host=somehost',
'--port=444',
'--ssl-ca=sslca',
@ -143,7 +141,7 @@ class MySqlDbshellCommandTestCase(SimpleTestCase):
'--ssl-key=sslkey',
'somedbname',
]
expected_env = None
expected_env = {'MYSQL_PWD': 'somepassword'}
self.assertEqual(
self.settings_to_cmd_args_env({
'NAME': 'somedbname',
@ -177,3 +175,23 @@ class MySqlDbshellCommandTestCase(SimpleTestCase):
),
(['mysql', 'somedbname', '--help'], None),
)
def test_crash_password_does_not_leak(self):
# The password doesn't leak in an exception that results from a client
# crash.
args, env = DatabaseClient.settings_to_cmd_args_env(
{
'NAME': 'somedbname',
'USER': 'someuser',
'PASSWORD': 'somepassword',
'HOST': 'somehost',
'PORT': 444,
'OPTIONS': {},
},
[],
)
fake_client = Path(__file__).with_name('fake_client.py')
args[0:1] = [sys.executable, str(fake_client)]
with self.assertRaises(subprocess.CalledProcessError) as ctx:
subprocess.run(args, check=True, env=env)
self.assertNotIn('somepassword', str(ctx.exception))