🛡️ Sentinel: [CRITICAL] Fix exposed database password - #90
Conversation
The `levelerdb setup` command accepted the MySQL database password as a plaintext argument without restricting execution to Direct Messages. If accidentally run in a public channel, the credentials would be exposed in the channel's message history. This patch enforces DM-only execution by checking `if ctx.guild` and safely attempting to delete the message if run in a public channel. Co-authored-by: keough99 <13394623+keough99@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
🚨 Severity: CRITICAL
💡 Vulnerability: The
levelerdb setupcommand accepted the MySQL database password as a plaintext argument. Without restricting execution to Direct Messages (DMs), running this command in a public channel would expose the database credentials to the entire server in the channel's message history.🎯 Impact: Attackers could harvest exposed database credentials from chat history, leading to unauthorized access, data breaches, or complete compromise of the underlying MySQL database.
🔧 Fix: Added a
ctx.guildcheck at the beginning of the command to enforce execution exclusively in Direct Messages. If a user attempts to run it in a server channel, the bot immediately attempts to securely delete the message (catchingdiscord.HTTPExceptionin case of missing permissions) and sends a warning instructing the user to use DMs.✅ Verification: Review the
levelerdb_setupcommand inleveler/commands.pyto confirm the DM-only restriction and message deletion logic are in place. Tested locally to ensure no syntax regressions.PR created automatically by Jules for task 286031050427538987 started by @keough99