Database password shows up in browser if apache mysql module not loaded

[perryb]

This might be a niche issue but I thought I'd log it here in case anyone thought it might be worth investigating:

While setting up a WordPress on AWS via a Docker image our Infrastructure Engineer came across an error message in their browser that exposed the database password.

This was triggered by an issue with Terraform in AWS which resulted in the WP image mounting before Apache had been properly configured, so no mysql module and hence the error message.

I'm not really up to speed with AWS so if you need more details I can get them from the engineer, they say that in turn this was triggered by a logged Terraform issue that appears to date back to 2017!

I imagine this is likely an edge case but thought I'd log it in case anyone thought it might be more significant, or possible to trigger in another context.

[perryb]

Screencap of error message

[johnbillion]

Thanks for the report @perryb.

Regarding the parameters being shown in the fatal error stack trace, there's nothing that WordPress can do about this except to implement the SensitiveParameter attribute. This is being tracked in #57304.

That said, this error should be caught during the bootstrap process of WordPress when it checks for the existence of the mysqli_connect function here: ​https://github.com/WordPress/wordpress-develop/blob/fd104aed1427167a8273bc6dc8dc43c1dd66ae02/src/wp-includes/load.php#L174-L204 . I can see from the stack trace that your site is running Query Monitor which likely means the wp-content/db.php file is in place which will cause this check to get skipped. The reason for this is in case a custom database driver is installed and WordPress lets it take over.

If you delete the wp-content/db.php file or deactivate Query Monitor then you should see the appropriate error message about the missing mysqli extension. If that's the case then I think we can close this ticket as there's nothing more that WordPress can do in this case.

[perryb]

That's very useful thank you - not least because I'd managed to miss that I still have Query Monitor installed and it needs to come off the production site anyway!

[johnbillion]

In that case I'll close this off. Cheers!