New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: gracefully handle command not found exception - avoid creds exposure #54406

Merged

taylorotwell merged 2 commits into laravel:11.x from chinmaypurav:feat/catch-for-db-command-to-mask-credentials

Jan 30, 2025

Contributor

chinmaypurav commented Jan 29, 2025 •

edited

Loading

When you run php artisan db on a shell, where the mysql binary is not available; it throws an error which logs at error level.

Any 3rd party log channels like Sentry also captures this info and the password in displayed/stored in plain text.

I came up with a way to fix that, I capture the exception and display error ONLY IF the command is not found (exit code 127 - see https://tldp.org/LDP/abs/html/exitcodes.html).
For any other type of exception, I let the exception to be thrown for the framework to handle.

chinmaypurav and others added 2 commits

January 29, 2025 23:05


          gracefully handle command not found exception to avoid exposure of cr…

412552d

…edentials


          Update DbCommand.php

94a7339

taylorotwell merged commit 62044a5 into laravel:11.x

14 checks passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet