galaxyproject / galaxyproject/galaxy
Lack of sanitisation for Pulsar AMQP URL
Open
area/jobs
area/security
kind/bug
kind/enhancement
- Dominant language
- Python
- Stars
- 1.9k
- Forks
- 1.2k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 158
Description
DB URL is sanitised but the amqp url prints out in cleartext:
```
Jul 09 13:46:25 test.internal.usegalaxy.eu python[396095]: galaxy.jobs.runners DEBUG 2019-07-09 13:46:25,551 Loading PulsarJobRunner with params: {'amqp_publish_retry_max_retries': '60', 'galaxy_url': 'https://usegalaxy.eu', 'amqp_publish_retry': 'True', 'amqp_ack_republish_time': '300', 'amqp_acknowledge': 'True', 'manager': '_default_', 'amqp_url': 'pyamqp://galaxy_test:rN@proxy.internal.galaxyproject.eu:5671//pulsar/galaxy_test?ssl=1', 'amqp_consumer_timeout': '2.0'}
```
Contributor guide
Assessment
This issue has not been assessed yet.