Skip to content

Possible credentials exposure? #13008

Closed
Closed
@ndoulgeridis

Description

@ndoulgeridis

Hello,

I got an unexpected "Too many connections" PDO exception. The problem is that somehow in app.php I got a white page with the Fatal error instead the custom nicely formatted 500 exception page. The worse was that inside the exception message was exposed my connection credentials. Error was:

Uncaught PHP Exception PDOException: "SQLSTATE[HY000] [1040] Too many connections" at ....vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php line 40 {"exception":"[object] (PDOException: SQLSTATE[HY000] [1040] Too many connections at .....vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php:40)"} []
Exception thrown when handling an exception (Twig_Error_Runtime: An exception has been thrown during the rendering of a template ("SQLSTATE[HY000] [1040] Too many connections") in "FOO::header.html.twig" at line 30.) {"exception":"[object] (PDOException: SQLSTATE[HY000] [1040] Too many connections at ...vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php:40)"} []

This was the email i got from monolog, in index.php there were another message that was exposing mysql credentials

Is that happening maybe because the 500 page requests as well MYSQL and gets error too? But in any case how can avoid credentials exposure?


Edit: A workaround is app.php to have error_reporting(0) by default. Do you think this is a right approach or do I miss something?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions