Severity: MEDIUM
Location: lib/Service/SymfonyEmailService.php lines 298–342, 351–372
Description:
Two issues in DSN construction:
-
Password leak in logs: Transport::fromDsn(sprintf('smtp://%s:%s@%s:%d', urlencode($user), urlencode($pass), ...)) then catches Exception and logs $e->getMessage(). On a malformed DSN, Symfony includes the full DSN string (with password) in the exception message, which is then written to the NC log.
-
Incorrect URL encoding: urlencode() encodes space as +, not %20. Passwords containing spaces or + are silently corrupted, causing authentication failures that are hard to diagnose.
Suggested fix:
- Use
rawurlencode() instead of urlencode() for DSN credential components.
- Before logging the exception message, strip credentials: replace the password substring with
***.
Source: deep team-reviewer pass 2026-05-27
Severity: MEDIUM
Location:
lib/Service/SymfonyEmailService.phplines 298–342, 351–372Description:
Two issues in DSN construction:
Password leak in logs:
Transport::fromDsn(sprintf('smtp://%s:%s@%s:%d', urlencode($user), urlencode($pass), ...))then catchesExceptionand logs$e->getMessage(). On a malformed DSN, Symfony includes the full DSN string (with password) in the exception message, which is then written to the NC log.Incorrect URL encoding:
urlencode()encodes space as+, not%20. Passwords containing spaces or+are silently corrupted, causing authentication failures that are hard to diagnose.Suggested fix:
rawurlencode()instead ofurlencode()for DSN credential components.***.Source: deep team-reviewer pass 2026-05-27