Skip to content

database password logged when SQL error occur #90

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Wingzzzzz opened this issue Oct 16, 2019 · 5 comments
Closed

database password logged when SQL error occur #90

Wingzzzzz opened this issue Oct 16, 2019 · 5 comments
Labels

Comments

@Wingzzzzz
Copy link

iOS 12.4
cordova-sqlcipher-adapter 0.4.1

As function of Cordova-sqlite-storage,
when SQL error occurs,
it logs database open args like:

2019-10-16 18:58:01.136887+0800 MyApp[18299:2294348] ERROR: execute sql with error : { db: 
   { openargs: 
      { name: 'app.db',
        key: 'password1',
        location: 'default',
        dblocation: 'nosync' },
     dbname: 'app.db',
     openSuccess: [Function],
     openError: [Function] },
  fn: [Function],
  error: [Function],
  success: undefined,
  txlock: true,
  readOnly: false,
  executes: [] }

The problem comes to cordova-sqlcipher-adapter is that the password is exposed whenever other get connected to the device to check device log.

@brody4hire
Copy link
Collaborator

Thanks, please accept my apologies for the extra-long delay. Definitely a security issue!

@Wingzzzzz
Copy link
Author

no problem, appreciate your effort on the project

@Wingzzzzz Wingzzzzz reopened this Dec 30, 2019
@brody4hire
Copy link
Collaborator

This kind of error log is not in the JavaScript code on this plugin. I think we can close this one.

@Wingzzzzz
Copy link
Author

have not looked into the logging related code.
but can i say this: options printed are not expected to have sensitive information

@brody4hire
Copy link
Collaborator

As I tried to explain before that log message is not part of this plugin. A https://stackoverflow.com/help/minimal-reproducible-example is needed to demonstrate your issue. Closing as invalid.

@brody4hire brody4hire unpinned this issue May 20, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants