fix(log): don"t print querylog target password when using a database

0xERR0R · Apr 2, 2024 · 2c6b704 · 2c6b704
1 parent 28f979f
commit 2c6b704
Show file tree

Hide file tree

Showing 2 changed files with 43 additions and 1 deletion.
diff --git a/config/query_log.go b/config/query_log.go
@@ -1,6 +1,9 @@
 package config
 
 import (
+	"net/url"
+	"strings"
+
 	"github.com/sirupsen/logrus"
 )
 
@@ -32,7 +35,7 @@ func (c *QueryLog) LogConfig(logger *logrus.Entry) {
 	logger.Infof("type: %s", c.Type)
 
 	if c.Target != "" {
-		logger.Infof("target: %s", c.Target)
+		logger.Infof("target: %s", c.censoredTarget())
 	}
 
 	logger.Infof("logRetentionDays: %d", c.LogRetentionDays)
@@ -41,3 +44,27 @@ func (c *QueryLog) LogConfig(logger *logrus.Entry) {
 	logger.Infof("flushInterval: %s", c.FlushInterval)
 	logger.Infof("fields: %s", c.Fields)
 }
+
+func (c *QueryLog) censoredTarget() string {
+	// Make sure there's a scheme, otherwise the user is parsed as the scheme
+	targetStr := c.Target
+	if !strings.Contains(targetStr, "://") {
+		targetStr = c.Type.String() + "://" + targetStr
+	}
+
+	target, err := url.Parse(targetStr)
+	if err != nil {
+		return c.Target
+	}
+
+	if target.User == nil {
+		return c.Target
+	}
+
+	// Drop the password since special chars like * get URL escaped
+	if pass, hasPass :=target.User.Password(); hasPass {
+		return strings.Replace(target.String(), pass, strings.Repeat("*", len(pass)), 1)
+	}
+
+	return target.String()
+}
diff --git a/config/query_log_test.go b/config/query_log_test.go
@@ -55,6 +55,21 @@ var _ = Describe("QueryLogConfig", func() {
 			Expect(hook.Calls).ShouldNot(BeEmpty())
 			Expect(hook.Messages).Should(ContainElement(ContainSubstring("logRetentionDays:")))
 		})
+
+		DescribeTable("doesn't print the target password", func(target string) {
+			cfg.Type = QueryLogTypeMysql
+			cfg.Target = target
+
+			cfg.LogConfig(logger)
+
+			Expect(hook.Calls).ShouldNot(BeEmpty())
+			Expect(hook.Messages).ShouldNot(ContainElement(ContainSubstring("password")))
+		},
+			Entry("without scheme", "user:password@localhost"),
+			Entry("with scheme", "scheme://user:password@localhost"),
+			Entry("no password", "localhost"),
+			Entry("not a URL", "invalid!://"),
+		)
 	})
 
 	Describe("SetDefaults", func() {