Error contains password in plaintext

Hi, I’m using ioredis like this (simplified):

import Redis from 'ioredis'

const password = process.env.REDIS_PASSWORD // e.g. 'abc123'
const redis = new Redis({ password })

redis.on('error', (error) => {
  logger.error('Redis error', error)
})

Due to a human error, the password used was not the correct one for my service, so ioredis could not connect. This resulted in the following error:

Error {
  command: {
    name: 'auth',
    args: ['abc123']
  }
}

Since this error gets emitted and ultimately logged, it ended up in plaintext in my service logs, which for some could equate to a security incident.

I’ve since made sure to omiterror.command.args before logging. But is this expected behavior? Is there a better way to handle this?

[luin]

Yeah, that sounds reasonable. Can you make a PR for that?

[smartinio]

Hey Luin! Okay, how about this?

Assuming that the consensus is that any data (not just passwords) is potentially sensitive:

Make the existence of error.command.args configurable through a flag (e.g. errorsContainCommandArgs). This could start as an opt-out, to not break current behavior. If the option is not explicitly set by the user, ioredis can log a warning:

[ioredis] Command args in errors are deprecated. In the future, command args will not automatically be included in the error object. To keep the current behavior, set errorsContainCommandArgs: true when configuring ioredis