Skip to content

Elasticsearch password print on clear in case of error #35530

@aarnaud

Description

@aarnaud

Description

On startup if gitea failed to init it connection to ElasticSearch, the string connection containing the password is printed.

but we can see that is also masked on an other line.

In this example password is xyz

2025/09/24 16:39:18 .../indexer/issues/indexer.go:103:InitIssueIndexer.1() [F] Unable to issueIndexer.Init with connection http://gitea:xyz@indexer-gitea-es-http:9200 Error: health check timeout: Head "http://gitea:***@indexer-gitea-es-http:9200": EOF: no Elasticsearch node available

Gitea Version

1.24.5

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Inside Kubernetes

Database

PostgreSQL

Metadata

Metadata

Labels

topic/securitySomething leaks user information or is otherwise vulnerable. Should be fixed!type/bug

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions