[AMQP] [Messenger] Do not leak any credentials when connection fails

ruudk · ruudk · commit 0f73092b1f09 · 2021-08-24T16:49:35.000+02:00
I noticed that when the connection to AMQP fails for whatever reason all the DSK credentials are leaked.

Yes, the password is masked. But it still leaks the server, port and username.

I think these things should be private and not be logged to a logger server or error capture service.
diff --git a/src/Symfony/Component/Messenger/Bridge/Amqp/Tests/Transport/ConnectionTest.php b/src/Symfony/Component/Messenger/Bridge/Amqp/Tests/Transport/ConnectionTest.php
@@ -559,10 +559,10 @@ public function testItDelaysTheMessageWithADifferentRoutingKeyAndTTLs()
         $connection->publish('{}', [], 120000);
     }
 
-    public function testObfuscatePasswordInDsn()
+    public function testNoCredentialLeakageWhenConnectionFails()
     {
         $this->expectException(\AMQPException::class);
-        $this->expectExceptionMessage('Could not connect to the AMQP server. Please verify the provided DSN. ({"host":"localhost","port":5672,"vhost":"/","login":"user","password":"********"})');
+        $this->expectExceptionMessage('Could not connect to the AMQP server. Please verify the provided DSN.');
         $factory = new TestAmqpFactory(
             $amqpConnection = $this->createMock(\AMQPConnection::class),
             $amqpChannel = $this->createMock(\AMQPChannel::class),
diff --git a/src/Symfony/Component/Messenger/Bridge/Amqp/Transport/Connection.php b/src/Symfony/Component/Messenger/Bridge/Amqp/Transport/Connection.php
@@ -495,11 +495,7 @@ public function channel(): \AMQPChannel
             try {
                 $connection->{$connectMethod}();
             } catch (\AMQPConnectionException $e) {
-                $credentials = $this->connectionOptions;
-                $credentials['password'] = '********';
-                unset($credentials['delay']);
-
-                throw new \AMQPException(sprintf('Could not connect to the AMQP server. Please verify the provided DSN. (%s).', json_encode($credentials, \JSON_UNESCAPED_SLASHES)), 0, $e);
+                throw new \AMQPException(sprintf('Could not connect to the AMQP server. Please verify the provided DSN.'), 0, $e);
             }
             $this->amqpChannel = $this->amqpFactory->createChannel($connection);
 

Original file line number	Diff line number	Diff line change
`@@ -559,10 +559,10 @@ public function testItDelaysTheMessageWithADifferentRoutingKeyAndTTLs()`
`559`	`559`	`$connection->publish('{}', [], 120000);`
`560`	`560`	`}`
`561`	`561`
`562`		`- public function testObfuscatePasswordInDsn()`
	`562`	`+ public function testNoCredentialLeakageWhenConnectionFails()`
`563`	`563`	`{`
`564`	`564`	`$this->expectException(\AMQPException::class);`
`565`		`- $this->expectExceptionMessage('Could not connect to the AMQP server. Please verify the provided DSN. ({"host":"localhost","port":5672,"vhost":"/","login":"user","password":"********"})');`
	`565`	`+ $this->expectExceptionMessage('Could not connect to the AMQP server. Please verify the provided DSN.');`
`566`	`566`	`$factory = new TestAmqpFactory(`
`567`	`567`	`$amqpConnection = $this->createMock(\AMQPConnection::class),`
`568`	`568`	`$amqpChannel = $this->createMock(\AMQPChannel::class),`