{"action":"created","issue":{"url":"https://api.github.com/repos/opscode-cookbooks/database/issues/71","labels_url":"https://api.github.com/repos/opscode-cookbooks/database/issues/71/labels{/name}","comments_url":"https://api.github.com/repos/opscode-cookbooks/database/issues/71/comments","events_url":"https://api.github.com/repos/opscode-cookbooks/database/issues/71/events","html_url":"https://github.com/opscode-cookbooks/database/issues/71","id":35480177,"number":71,"title":"Do not display password in output from chef-client on error","user":{"login":"eric-tucker","id":2693414,"avatar_url":"https://avatars.githubusercontent.com/u/2693414?v=3","gravatar_id":"","url":"https://api.github.com/users/eric-tucker","html_url":"https://github.com/eric-tucker","followers_url":"https://api.github.com/users/eric-tucker/followers","following_url":"https://api.github.com/users/eric-tucker/following{/other_user}","gists_url":"https://api.github.com/users/eric-tucker/gists{/gist_id}","starred_url":"https://api.github.com/users/eric-tucker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eric-tucker/subscriptions","organizations_url":"https://api.github.com/users/eric-tucker/orgs","repos_url":"https://api.github.com/users/eric-tucker/repos","events_url":"https://api.github.com/users/eric-tucker/events{/privacy}","received_events_url":"https://api.github.com/users/eric-tucker/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2014-06-11T12:58:12Z","updated_at":"2015-04-08T00:01:11Z","closed_at":null,"body":"Working with the mysql_database_user resource, a failed connection to the database will result in the password being displayed in plain text in the output from chef client.  For example, the following is spit out from a failed chef-client run.\r\n\r\n````\r\nmysql_database_user(\"create-db-user\") do\r\n  provider Chef::Provider::Database::MysqlUser\r\n  action [:grant]\r\n  retries 0\r\n  retry_delay 2\r\n  guard_interpreter :default\r\n  database_name \"mydb\"\r\n  username \"myuser\"\r\n  host \"10.%\"\r\n  privileges [:select, :delete, :update, :insert]\r\n  cookbook_name \"mycookbook\"\r\n  recipe_name \"myrecipe\"\r\n  connection {:host=>\"10.0.0.1\", :username=>\"root\", :password=>\"my_root_password_displayed_in_plain_text\"}\r\n  password \"my_new_user_password_in_plain_text\"\r\nend\r\n````\r\n\r\nThis is obviously a security hole that should be fixed."},"comment":{"url":"https://api.github.com/repos/opscode-cookbooks/database/issues/comments/90764634","html_url":"https://github.com/opscode-cookbooks/database/issues/71#issuecomment-90764634","issue_url":"https://api.github.com/repos/opscode-cookbooks/database/issues/71","id":90764634,"user":{"login":"evaryont","id":14547,"avatar_url":"https://avatars.githubusercontent.com/u/14547?v=3","gravatar_id":"","url":"https://api.github.com/users/evaryont","html_url":"https://github.com/evaryont","followers_url":"https://api.github.com/users/evaryont/followers","following_url":"https://api.github.com/users/evaryont/following{/other_user}","gists_url":"https://api.github.com/users/evaryont/gists{/gist_id}","starred_url":"https://api.github.com/users/evaryont/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/evaryont/subscriptions","organizations_url":"https://api.github.com/users/evaryont/orgs","repos_url":"https://api.github.com/users/evaryont/repos","events_url":"https://api.github.com/users/evaryont/events{/privacy}","received_events_url":"https://api.github.com/users/evaryont/received_events","type":"User","site_admin":false},"created_at":"2015-04-08T00:01:11Z","updated_at":"2015-04-08T00:01:11Z","body":"Is there a way to force `sensitive true` in an LWRP? That would be the best solution, I think.\r\n\r\nIn the mean time, you can add it to all of your uses for mysql_database_user. Though this precaution is still defeated until #93 is solved, or #138 is merged."}}