MonetDB / pymonetdb

The Python API for MonetDB
https://www.monetdb.org/
Mozilla Public License 2.0
28 stars 20 forks source link

Connection object leaks the password #93

Closed evangelos-dimitriadis closed 2 years ago

evangelos-dimitriadis commented 3 years ago

The connection object has a mapi object, which has a password field. The password is plain text. I was wondering if there is a way to hide that field.

Psycopg for example doesn't return the password, but probably if someone inspects the memory of the program they could find it: https://www.psycopg.org/docs/connection.html?highlight=password

gijzelaerr commented 2 years ago

i guess we could replace the self.passwords and just pass it as an argument during init in mapi.py.