erica push insecurely echoes password to console
Open
- Dominant language
- JavaScript
- Stars
- 264
- Forks
- 30
- PR merge metrics
- No merged PRs in 30d
Description
```
% erica push . default
==> couchapp (push)
==> Successfully pushed. You can browse it at: http://myuser:mypassword@127.0.0.1:5984/mydb/_design/myapp/_rewrite/
```
This is a shoulder-surfing risk. It would be better to strip at least the password from the URL.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the code that handles the `erica push` command and prints the successful push URL. Trace how that URL is assembled, then verify the console output no longer exposes the password while retaining the usable destination URL.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100