aboutsummaryrefslogtreecommitdiffstats
path: root/railties
diff options
context:
space:
mode:
authorbogdanvlviv <bogdanvlviv@gmail.com>2018-08-28 09:20:18 +0300
committerbogdanvlviv <bogdanvlviv@gmail.com>2018-08-29 12:40:30 +0300
commit9b455fe6f0e5d21e8c428da5bdba7d0f3162aef7 (patch)
treeb5836118dfd7a5910fca16571e21be6d8467e1b0 /railties
parent068fe7dc9045856b822833db5cb7cb690e6000d7 (diff)
downloadrails-9b455fe6f0e5d21e8c428da5bdba7d0f3162aef7.tar.gz
rails-9b455fe6f0e5d21e8c428da5bdba7d0f3162aef7.tar.bz2
rails-9b455fe6f0e5d21e8c428da5bdba7d0f3162aef7.zip
Prevent leaking of user's DB credentials on `rails db:create` failure
Issue #27852 reports that when `rails db:create` fails, it causes leaking of user's DB credentials to $stderr. We print a DB's configuration hash in order to help users more quickly to figure out what could be wrong with his configuration. This commit changes message from "Couldn't create database for #{configuration.inspect}" to "Couldn't create '#{configuration['database']}' database. Please check your configuration.". There are two PRs that fixing it #27878, #27879, but they need a bit more work. I decided help to finish this and added Author of those PRs credit in this commit. Since it is a security issue, I think we should backport it to `5-2-stable`, and `5-1-stable`. Guided by https://edgeguides.rubyonrails.org/maintenance_policy.html#security-issues Fixes #27852 Closes #27879 Related to #27878 [Alexander Marrs & bogdanvlviv]
Diffstat (limited to 'railties')
-rw-r--r--railties/test/application/rake/dbs_test.rb2
1 files changed, 1 insertions, 1 deletions
diff --git a/railties/test/application/rake/dbs_test.rb b/railties/test/application/rake/dbs_test.rb
index 0594236b1f..56423356bb 100644
--- a/railties/test/application/rake/dbs_test.rb
+++ b/railties/test/application/rake/dbs_test.rb
@@ -93,7 +93,7 @@ module ApplicationTests
test "db:create failure because bad permissions" do
with_bad_permissions do
output = rails("db:create", allow_failure: true)
- assert_match(/Couldn't create database/, output)
+ assert_match("Couldn't create '#{database_url_db_name}' database. Please check your configuration.", output)
assert_equal 1, $?.exitstatus
end
end