Redact database URL password (#2441)

* Redact database URL password * More idiomatic result ignoring Co-authored-by: David Cook <[email protected]> --------- Co-authored-by: David Cook <[email protected]>
divviup · Jan 6, 2024 · cd2cdfe · cd2cdfe
1 parent 74fb29b
commit cd2cdfe
Showing 1 changed file with 14 additions and 1 deletion.
diff --git a/aggregator/src/config.rs b/aggregator/src/config.rs
@@ -65,7 +65,7 @@ pub trait BinaryConfig: Debug + DeserializeOwned {
 #[derivative(Debug)]
 pub struct DbConfig {
     /// URL at which to connect to the database.
-    #[derivative(Debug(format_with = "std::fmt::Display::fmt"))]
+    #[derivative(Debug(format_with = "format_database_url"))]
     pub url: Url,
 
     /// Timeout in seconds to apply when creating, waiting for, or recycling
@@ -94,6 +94,19 @@ impl DbConfig {
     }
 }
 
+/// Makes a best-effort attempt to redact the password from the database URL, so that it is safe
+/// to display in logs.
+fn format_database_url(url: &Url, fmt: &mut std::fmt::Formatter) -> Result<(), std::fmt::Error> {
+    match url.password() {
+        Some(_) => {
+            let mut url = url.clone();
+            let _ = url.set_password(Some("REDACTED"));
+            fmt.write_str(url.as_str())
+        }
+        None => fmt.write_str(url.as_str()),
+    }
+}
+
 /// Configuration options for the Taskprov extension. This extension is
 /// described in [draft-wang-ppm-dap-taskprov][spec], although its configuration
 /// options are implementation-specific.