Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Ellipsis] [BUG] Zep Admin console leaks database password #318

Merged
merged 2 commits into from
Mar 9, 2024

Conversation

ellipsis-dev[bot]
Copy link
Contributor

@ellipsis-dev ellipsis-dev bot commented Mar 8, 2024

Summary:

⚠️ We couldn't build/test your project to verify our changes. Add a Dockerfile to significantly improve code quality.

Issue: #316

Implementation:

  1. Update the regular expression in redactHTMLEncodeConfig
    • In the file /pkg/server/webhandlers/settings.go, locate the function redactHTMLEncodeConfig. Find the line with the regular expression (?i:postgres://[^:]+:)([^@]+). Replace this regular expression with (?i)(postgres://[^:]+:)([^@]+). This change moves the case-insensitive flag out of the first group, making it a capturing group and fixing the issue with the password not being redacted.
  2. Test the updated regular expression
    • Use the Go playground link provided by the user to test the updated regular expression. Replace the regular expression in the Go playground with the updated one: (?i)(postgres://[^:]+:)([^@]+). Run the code and confirm that the password is correctly redacted from the DSN.

Report:

Step Result Details
1
Update the regular expression in redactHTMLEncodeConfigUpdated the regular expression in the redactHTMLEncodeConfig function to correctly redact the Postgres password.
2
Test the updated regular expressionUpdated the regular expression in the redactHTMLEncodeConfig function to correctly redact the Postgres password.

Something look wrong?: If this Pull Request doesn't contain the expected changes, add more information to #316. Then, add the ellipsis:create label to try again. For more information, check the documentation.

Co-authored-by: jmkinard <30598559+jmkinard@users.noreply.github.com>
@danielchalef danielchalef merged commit d737e95 into main Mar 9, 2024
5 checks passed
@danielchalef danielchalef deleted the ellipsis/wflow_79bbr4h6aKx36yYb_IIAU branch March 9, 2024 00:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants