Uploaded image for project: 'Bitbucket Data Center'
  1. Bitbucket Data Center
  2. BSERV-13222

Bitbucket displays sensitive DB details in error message in browser

    XMLWordPrintable

Details

    Description

      Issue Summary

      On application startup, if the database is down the Bitbucket application displays the sensitive database hostname & port details in the error message in browser.
      Error Message:

      The database, as currently configured, is not accessible.
      Connection to <DB-HOSTNAME>:<PORT> refused. Check that the hostname and port are correct and that the postmaster is accepting TCP/IP connections.
      

      This is reproducible on Data Center: (yes)

      Steps to Reproduce

      1. Shutdown both the Bitbucket application and the external database.
      2. Start the Bitbucket application and access the <BITBUCKET-BASE-URL> in the browser.

      Expected Results

      The error message in the browser should display generic database connectivity issue.

      Actual Results

      The error message in the browser displays the sensitive <DB-HOSTNAME>:<PORT> that can be seen by any user accessing the Bitbucket base url at that time.

      The database, as currently configured, is not accessible.
      Connection to <DB-HOSTNAME>:<PORT> refused. Check that the hostname and port are correct and that the postmaster is accepting TCP/IP connections.
      

      Workaround

      Currently no workaround to hide this sensitive details in the error message.

      Attachments

        Issue Links

          Activity

            People

              khughes@atlassian.com Kristy
              681995654583 Rajesh (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: