Refs #32061 -- Prevented password leak on MySQL dbshell crash.

The usage of the --password flag when invoking the mysql CLI has the
potential of exposing the password in plain text if the command happens
to crash due to the inclusion of args provided to
subprocess.run(check=True) in the string representation of the
subprocess.CalledProcessError exception raised on non-zero return code.

Since this has the potential of leaking the password to logging
facilities configured to capture crashes (e.g. sys.excepthook, Sentry)
it's safer to rely on the MYSQL_PWD environment variable instead even
if its usage is discouraged due to potential leak through the ps
command on old flavors of Unix.

Thanks Charlie Denton for reporting the issue to the security team.

Refs #24999.

django/db/backends/mysql/client.py

@@ -7,6 +7,7 @@ class DatabaseClient(BaseDatabaseClient):
     @classmethod
     def settings_to_cmd_args_env(cls, settings_dict, parameters):
         args = [cls.executable_name]
+        env = None
         db = settings_dict['OPTIONS'].get('db', settings_dict['NAME'])
         user = settings_dict['OPTIONS'].get('user', settings_dict['USER'])
         password = settings_dict['OPTIONS'].get(
@@ -27,7 +28,14 @@ class DatabaseClient(BaseDatabaseClient):
         if user:
             args += ["--user=%s" % user]
         if password:
-            args += ["--password=%s" % password]
+            # The MYSQL_PWD environment variable usage is discouraged per
+            # MySQL's documentation due to the possibility of exposure through
+            # `ps` on old Unix flavors but --password suffers from the same
+            # flaw on even more systems. Usage of an environment variable also
+            # prevents password exposure if the subprocess.run(check=True) call
+            # raises a CalledProcessError since the string representation of
+            # the latter includes all of the provided `args`.
+            env = {'MYSQL_PWD': password}
         if host:
             if '/' in host:
                 args += ["--socket=%s" % host]
@@ -46,4 +54,4 @@ class DatabaseClient(BaseDatabaseClient):
         if db:
             args += [db]
         args.extend(parameters)
-        return args, None
+        return args, env

tests/dbshell/test_mysql.py

@@ -1,3 +1,7 @@
+import subprocess
+import sys
+from pathlib import Path
+
 from django.db.backends.mysql.client import DatabaseClient
 from django.test import SimpleTestCase
 
@@ -16,12 +20,11 @@ class MySqlDbshellCommandTestCase(SimpleTestCase):
         expected_args = [
             'mysql',
             '--user=someuser',
-            '--password=somepassword',
             '--host=somehost',
             '--port=444',
             'somedbname',
         ]
-        expected_env = None
+        expected_env = {'MYSQL_PWD': 'somepassword'}
         self.assertEqual(
             self.settings_to_cmd_args_env({
                 'NAME': 'somedbname',
@@ -41,12 +44,11 @@ class MySqlDbshellCommandTestCase(SimpleTestCase):
         expected_args = [
             'mysql',
             '--user=optionuser',
-            '--password=optionpassword',
             '--host=optionhost',
             '--port=%s' % options_port,
             'optiondbname',
         ]
-        expected_env = None
+        expected_env = {'MYSQL_PWD': 'optionpassword'}
         self.assertEqual(
             self.settings_to_cmd_args_env({
                 'NAME': 'settingdbname',
@@ -69,12 +71,11 @@ class MySqlDbshellCommandTestCase(SimpleTestCase):
         expected_args = [
             'mysql',
             '--user=someuser',
-            '--password=optionpassword',
             '--host=somehost',
             '--port=444',
             'somedbname',
         ]
-        expected_env = None
+        expected_env = {'MYSQL_PWD': 'optionpassword'}
         self.assertEqual(
             self.settings_to_cmd_args_env({
                 'NAME': 'somedbname',
@@ -91,13 +92,12 @@ class MySqlDbshellCommandTestCase(SimpleTestCase):
         expected_args = [
             'mysql',
             '--user=someuser',
-            '--password=somepassword',
             '--host=somehost',
             '--port=444',
             '--default-character-set=utf8',
             'somedbname',
         ]
-        expected_env = None
+        expected_env = {'MYSQL_PWD': 'somepassword'}
         self.assertEqual(
             self.settings_to_cmd_args_env({
                 'NAME': 'somedbname',
@@ -114,11 +114,10 @@ class MySqlDbshellCommandTestCase(SimpleTestCase):
         expected_args = [
             'mysql',
             '--user=someuser',
-            '--password=somepassword',
             '--socket=/path/to/mysql.socket.file',
             'somedbname',
         ]
-        expected_env = None
+        expected_env = {'MYSQL_PWD': 'somepassword'}
         self.assertEqual(
             self.settings_to_cmd_args_env({
                 'NAME': 'somedbname',
@@ -135,7 +134,6 @@ class MySqlDbshellCommandTestCase(SimpleTestCase):
         expected_args = [
             'mysql',
             '--user=someuser',
-            '--password=somepassword',
             '--host=somehost',
             '--port=444',
             '--ssl-ca=sslca',
@@ -143,7 +141,7 @@ class MySqlDbshellCommandTestCase(SimpleTestCase):
             '--ssl-key=sslkey',
             'somedbname',
         ]
-        expected_env = None
+        expected_env = {'MYSQL_PWD': 'somepassword'}
         self.assertEqual(
             self.settings_to_cmd_args_env({
                 'NAME': 'somedbname',
@@ -177,3 +175,23 @@ class MySqlDbshellCommandTestCase(SimpleTestCase):
             ),
             (['mysql', 'somedbname', '--help'], None),
         )
+
+    def test_crash_password_does_not_leak(self):
+        # The password doesn't leak in an exception that results from a client
+        # crash.
+        args, env = DatabaseClient.settings_to_cmd_args_env(
+            {
+                'NAME': 'somedbname',
+                'USER': 'someuser',
+                'PASSWORD': 'somepassword',
+                'HOST': 'somehost',
+                'PORT': 444,
+                'OPTIONS': {},
+            },
+            [],
+        )
+        fake_client = Path(__file__).with_name('fake_client.py')
+        args[0:1] = [sys.executable, str(fake_client)]
+        with self.assertRaises(subprocess.CalledProcessError) as ctx:
+            subprocess.run(args, check=True, env=env)
+        self.assertNotIn('somepassword', str(ctx.exception))