Merge pull request #206 from allthedrones/master

Exclude password from exception and debug messages.

Author: mythz

src/ServiceStack.Redis/RedisNativeClient_Utils.cs

@@ -270,9 +270,11 @@ private bool HandleSocketException(SocketException ex)
         private RedisResponseException CreateResponseError(string error)
         {
             HadExceptions = true;
+            string safeLastCommand = (Password == null) ? lastCommand : lastCommand.Replace(Password, "");
+
             var throwEx = new RedisResponseException(
                 string.Format("{0}, sPort: {1}, LastCommand: {2}",
-                    error, clientPort, lastCommand));
+                    error, clientPort, safeLastCommand));
             log.Error(throwEx.Message);
             throw throwEx;
         }
@@ -586,10 +588,13 @@ protected void CmdLog(byte[][] args)
             var sb = new StringBuilder();
             foreach (var arg in args)
             {
+                var strArg = arg.FromUtf8Bytes();
+                if (strArg == Password) continue;
+
                 if (sb.Length > 0)
                     sb.Append(" ");
-
-                sb.Append(arg.FromUtf8Bytes());
+                
+                sb.Append(strArg);
 
                 if (sb.Length > 100)
                     break;
@@ -599,7 +604,7 @@ protected void CmdLog(byte[][] args)
             {
                 this.lastCommand = this.lastCommand.Substring(0, 100) + "...";
             }
-
+            
             log.Debug("S: " + this.lastCommand);
         }
 

tests/ServiceStack.Redis.Tests/RedisPasswordTests.cs

@@ -2,10 +2,11 @@
 
 namespace ServiceStack.Redis.Tests
 {
-    [Explicit("Integration")]
     [TestFixture]
     public class RedisPasswordTests
     {
+
+        [Explicit("Integration")]
         [Test]
         public void Can_connect_to_Slaves_and_Masters_with_Password()
         {
@@ -22,5 +23,25 @@ public void Can_connect_to_Slaves_and_Masters_with_Password()
                 Assert.That(value, Is.EqualTo("Bar"));
             }
         }
+
+        [Test]
+        [ExpectedException(typeof(ServiceStack.Redis.RedisResponseException), UserMessage = "Expected an exception after Redis AUTH command; try using a password that doesn't match.")]
+        public void Passwords_are_not_leaked_in_exception_messages()
+        {
+            const string password = "yesterdayspassword";
+            try
+            {
+                var factory = new PooledRedisClientManager(password + "@" + TestConfig.SingleHost); // redis will throw when using password and it's not configured
+                using (var redis = factory.GetClient())
+                {
+                    redis.SetEntry("Foo", "Bar");
+                }
+            }
+            catch (RedisResponseException ex)
+            {
+                Assert.That(ex.Message, Is.Not.StringContaining(password));
+                throw;
+            }
+        }
     }
 }