DB Credentials Leak When Using AlloyDB

[pvpablo]

Describe the bug

When using AlloyDB, credentials are leaked through error logging in the frontend.

To Reproduce

1. Add an item to cart (say, Tank Top, qty=1)
2. Go back and add the same item again (Tank Top, qty=2)
3. An error page is displayed
4. The error lists DB credentials in plain text

Logs

rpc error: code = FailedPrecondition desc = Can't access cart storage at Host=PRIVATE_IP;Username=USER;Password=PASSWORD;Database=carts. Npgsql.PostgresException (0x80004005): 23505: duplicate key value violates unique constraint "cart_items_pkey"

Environment

Frontend, Chrome Browser

Exposure

Persistent

[bourgeoisor]

Good catch.

This is the line where the log comes from:

microservices-demo/src/cartservice/src/cartstore/AlloyDBCartStore.cs

Line 92 in b0ee845

new Status(StatusCode.FailedPrecondition, $"Can't access cart storage at {connectionString}. {ex}"));