search

Voxel-Fox-Ltd / Flower

A Discord bot for growing virtual flowers in a virtual garden.
GNU General Public License v2.0
16 stars 12 forks source link

Secuity issue: asyncpg errors are sent to discord #15

Closed AnotherZane closed 3 years ago

AnotherZane commented 3 years ago

When the bot fails to connect to the database, the connection refused error is sent to discord. This error message includes the ip of the server and the port on which the database is hosted at. The ip is currently localhost but this could potentially leak a new database host ip in the future. I highly suggest sending a generic error message instead - with specific error codes so you can still debug as to what went wrong.

An example of the current behaviour

ethanbreck commented 3 years ago

The IP address is Localhost, but the issue seems to be the Docker container for the flower bot, is having issues talking to the Redis server they have managing the data for each user's plants.

4Kaylum commented 3 years ago

The IP is localhost and the port is Postgres default. I have my Postgres configured to whitelist IPs so it can't be accessed externally.

This isn't really a security issue as much as it is just me being lazy with error messages.

4Kaylum commented 3 years ago

the issue seems to be the Docker container for the flower bot, is having issues talking to the Redis server they have managing the data for each user's plants.

The issue was actually much stupider: the bot's log files filled the disk because I didn't set up log rotation properly. Whoops.

ethanbreck commented 3 years ago

Ah, yeah. That would cause it, Ive made the same error on some of things