From bc7cea7b56a58836687d1c5fd4de52670368407b Mon Sep 17 00:00:00 2001 From: benthecarman Date: Fri, 28 Aug 2026 18:00:41 -0500 Subject: [PATCH] Reject empty metrics credentials Reject configured empty usernames or passwords so Basic Auth cannot be enabled with a predictable empty credential pair. This commit was created with assistance from Codex. --- ldk-server/src/util/config.rs | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/ldk-server/src/util/config.rs b/ldk-server/src/util/config.rs index b8028ef6..cbd5fff3 100644 --- a/ldk-server/src/util/config.rs +++ b/ldk-server/src/util/config.rs @@ -562,7 +562,16 @@ impl ConfigBuilder { && (metrics_username.is_some() != metrics_password.is_some()) { return Err(io::Error::new(io::ErrorKind::InvalidInput, - "Both `metrics.username` and `metrics.password` must be set if authentication is used for metrics.")); + "Both `metrics.username` and `metrics.password` must be set if authentication is used for metrics.")); + } + + if metrics_enabled + && (metrics_username.as_deref() == Some("") || metrics_password.as_deref() == Some("")) + { + return Err(io::Error::new( + io::ErrorKind::InvalidInput, + "Metrics authentication credentials must not be empty.", + )); } let tor_proxy_address: Option = self @@ -2240,6 +2249,22 @@ mod tests { assert_eq!(err.kind(), io::ErrorKind::InvalidInput); } + #[test] + fn test_metrics_enabled_fails_with_empty_auth() { + for (username, password) in [("", "password"), ("admin", ""), ("", "")] { + let config = format!( + "{}\n[metrics]\nenabled = true\nusername = {:?}\npassword = {:?}", + DEFAULT_CONFIG, username, password + ); + let mut builder = ConfigBuilder::default(); + builder.merge_toml(toml::from_str(&config).unwrap()); + + let err = builder.build().unwrap_err(); + assert_eq!(err.kind(), io::ErrorKind::InvalidInput); + assert_eq!(err.to_string(), "Metrics authentication credentials must not be empty."); + } + } + #[test] fn test_hrn_config() { let storage_path = std::env::temp_dir();