hard-coded guest user and guest password

[amitagarwal-dev]

Hi,

A harcoded guest user and guest password is present inside the amqplib node_module which is reported in the vapt report created by our client.
Is there any chance of removing it from the upcoming releases?

path: node_modules/amqplib/lib/connect.js:80
"version": "0.10.4",

function credentialsFromUrl(parts) {
  var user = 'guest', passwd = 'guest';
  if (parts.username != '' || parts.password != '') {
    user = (parts.username) ? unescape(parts.username) : '';
    passwd = (parts.password) ? unescape(parts.password) : '';
  }
  return credentials.plain(user, passwd);
}

[cressie176]

Hi @amitagarwal-dev,

Thanks for opening this issue. This is the default username and password for RabbitMQ. It is published publicly on the RabbitMQ Website and by default only usable on connections from localhost. Including it in the amqplib codebase does not introduce a security issue but removing it would be a breaking change. It is therefore not something I would consider doing.