search

nikepan / clickhouse-bulk

Collects many small inserts to ClickHouse and send in big inserts
Apache License 2.0
474 stars 87 forks source link

Credential disclosure in logs #17

Closed joe-bowman closed 4 years ago

joe-bowman commented 4 years ago

If forwarding queries on to a server requiring authentication, if URL is of the form http://username:password@localhost:8123, these credentials are disclosed in the log file by https://github.com/nikepan/clickhouse-bulk/blob/4f084dd00b9c39e21a32cffedfc54d314bb46f18/clickhouse.go#L182

We should redact the password portion of this string before echoing it.

nikepan commented 4 years ago

oh. thanks. I'll fix it tomorrow

nikepan commented 4 years ago

fixed https://github.com/nikepan/clickhouse-bulk/releases/tag/v1.2.2 - log only server url