Bitbucket displays sensitive DB details in error message in browser

XMLWordPrintable

    • 1
    • Severity 3 - Minor

      Issue Summary

      On application startup, if the database is down the Bitbucket application displays the sensitive database hostname & port details in the error message in browser.
      Error Message:

      The database, as currently configured, is not accessible.
      Connection to <DB-HOSTNAME>:<PORT> refused. Check that the hostname and port are correct and that the postmaster is accepting TCP/IP connections.
      

      This is reproducible on Data Center: (yes)

      Steps to Reproduce

      1. Shutdown both the Bitbucket application and the external database.
      2. Start the Bitbucket application and access the <BITBUCKET-BASE-URL> in the browser.

      Expected Results

      The error message in the browser should display generic database connectivity issue.

      Actual Results

      The error message in the browser displays the sensitive <DB-HOSTNAME>:<PORT> that can be seen by any user accessing the Bitbucket base url at that time.

      The database, as currently configured, is not accessible.
      Connection to <DB-HOSTNAME>:<PORT> refused. Check that the hostname and port are correct and that the postmaster is accepting TCP/IP connections.
      

      Workaround

      Currently no workaround to hide this sensitive details in the error message.

              Assignee:
              Kristy
              Reporter:
              Rajesh (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: