Skip to content

[MEDIUM] M4: SMTP DSN can leak password in log + urlencode corrupts passwords with spaces #344

Description

@rubenvdlinde

Severity: MEDIUM

Location: lib/Service/SymfonyEmailService.php lines 298–342, 351–372

Description:
Two issues in DSN construction:

  1. Password leak in logs: Transport::fromDsn(sprintf('smtp://%s:%s@%s:%d', urlencode($user), urlencode($pass), ...)) then catches Exception and logs $e->getMessage(). On a malformed DSN, Symfony includes the full DSN string (with password) in the exception message, which is then written to the NC log.

  2. Incorrect URL encoding: urlencode() encodes space as +, not %20. Passwords containing spaces or + are silently corrupted, causing authentication failures that are hard to diagnose.

Suggested fix:

  • Use rawurlencode() instead of urlencode() for DSN credential components.
  • Before logging the exception message, strip credentials: replace the password substring with ***.

Source: deep team-reviewer pass 2026-05-27

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions