BrighterCommand / BrighterCommand/Brighter

MsSqlMessageQueue logs the full connection string, including the password, at Debug

Open
#4,346 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
2.5k
Forks
296
Avg merge
1d 11h
Merged PRs (30d)
21

Description

`src/Paramore.Brighter.MessagingGateway.MsSql/SqlQueues/MsSqlMessageQueue.cs:34`:

```csharp
Log.MsSqlMessageQueueCtor(s_logger, _configuration.ConnectionString, _configuration.QueueStoreTable);
```

and the message template at `:254`:

```csharp
[LoggerMessage(LogLevel.Debug, "MsSqlMessageQueue({ConnectionString}, {QueueStoreTable})")]
```

A SQL Server connection string routinely carries `Password=...`. At `Debug` this reaches every configured sink — console, file, and whatever aggregator the application ships to.

### Why it matters more than it used to

The MSSQL messaging gateway's own documentation now tells a reader to put a password in that string, and the sample under `samples/TaskQueue/MsSqlMessagingGateway` demonstrates it. That sample keeps the credential off stdout **only** because `GreetingsSender` happens to set `MinimumLevel.Override` for this category — a mitigation that works for one sample and for nobody else. Anyone running Brighter at `Debug` gets the password in their logs.

This was raised independently by three separate review rounds on #4331, which is usually a sign the fix belongs in the library rather than in another README paragraph.

### Suggested fix

Log the server and database without the credential — `SqlConnectionStringBuilder` gives you `DataSource` and `InitialCatalog` directly:

```csharp
var builder = new SqlConnectionStringBuilder(_configuration.ConnectionString);
Log.MsSqlMessageQueueCtor(s_logger, builder.DataSource, builder.InitialCatalog, _configuration.QueueStoreTable);
```

That keeps everything the log line is actually useful for — which server, which database, which table — and drops the part nobody wanted in a log. The sample's `MinimumLevel.Override` and the README's warning about it could then both be deleted rather than maintained.

Contributor guide

Open the contributing guide

Research direction

Start in src/Paramore.Brighter.MessagingGateway.MsSql/SqlQueues/MsSqlMessageQueue.cs at the constructor log call and the LoggerMessage template around line 254. Inspect the sample under samples/TaskQueue/MsSqlMessagingGateway and the README warning. Done means logs retain server, database, and table context without exposing the connection-string password, and the sample override and warning are removed.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, sql
Domain
backend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
76/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.