Repository navigation
ateapi: stop logging the raw PostgreSQL connection string (which might contain db password) at startup - #1833
Merged
Jeff Luo (JeffLuoo) merged 2 commits intoOct 1, 2026
Conversation
Da Huang (git286)
requested a review
from Julian Gutierrez Oschmann (juli4n)
September 23, 2026 19:52
| } | ||
| cfg, err := pgconn.ParseConfig(connString) | ||
| if err != nil { | ||
| return slog.String(key, "<unparseable>") |
Collaborator
There was a problem hiding this comment.
probably want to be more specific?
""
Collaborator
Author
There was a problem hiding this comment.
If you mean including more information from the error, I kept the marker on purpose and did not include the error. pgx's ParseConfigError.Error() embeds the whole connection string, password masked by regex.
Renamed it to to make it a little more sepcific but still static.
Bowei Du (bowei)
previously approved these changes
Sep 23, 2026
Bowei Du (bowei)
added
kind/bug
Da Huang (git286)
force-pushed
the
ateapi-redact-dsn-log
branch
from
September 24, 2026 20:09
cfde3e4 to
e2e0102
Compare
Collaborator
Author
|
Bowei Du (@bowei) rebased on main (small conflict with #1839, only the connectStore comment) and renamed the marker as you suggested. Your approval got dismissed by the push, could you re-approve and merge if it looks good? Thanks. |
Bowei Du (bowei)
previously approved these changes
Sep 29, 2026
logFlagValues writes every flag to the log when the server starts, and that included --postgres-connection-string verbatim. The bundled database and Cloud SQL IAM auth use passwordless strings, but an external database DSN can carry a password, and it was written to the log on every restart. Log the parsed, non-secret parts instead: host, port, database, user, whether a password is set and whether TLS is on. pgconn.ParseConfig handles both the URI and the libpq key=value forms, so no string rewriting is needed and nothing is echoed. A string that does not parse is logged as "<unparseable>"; connectStore still reports the real error.
Da Huang (git286)
force-pushed
the
ateapi-redact-dsn-log
branch
from
September 30, 2026 12:55
e2e0102 to
50f2bb1
Compare
Jeff Luo (JeffLuoo)
enabled auto-merge
October 1, 2026 13:43
Jeff Luo (JeffLuoo)
approved these changes
Oct 1, 2026
Quentin Bisson (QuentinBisson)
pushed a commit
to giantswarm/substrate
that referenced
this pull request
Oct 6, 2026
…t contain db password) at startup (agent-substrate#1833) logFlagValues writes every flag to the log when the server starts, and that included --postgres-connection-string verbatim. The bundled database and Cloud SQL IAM auth use passwordless strings, but an external database DSN can carry a password, and it was written to the log on every restart. Log the parsed, non-secret parts instead: host, port, database, user, whether a password is set and whether TLS is on. pgconn.ParseConfig handles both the URI and the libpq key=value forms, so no string rewriting is needed and nothing is echoed. A string that does not parse is logged as "<unparseable>"; connectStore still reports the real error. Fixes agent-substrate#1832 > It's a good idea to open an issue first for discussion. - [x] Tests pass - [x] Appropriate changes to documentation are included in the PR (cherry picked from commit 38b9522)
Quentin Bisson (QuentinBisson)
added a commit
to giantswarm/substrate
that referenced
this pull request
Oct 6, 2026
Quentin Bisson (QuentinBisson)
pushed a commit
to giantswarm/substrate
that referenced
this pull request
Oct 8, 2026
…t contain db password) at startup (agent-substrate#1833) logFlagValues writes every flag to the log when the server starts, and that included --postgres-connection-string verbatim. The bundled database and Cloud SQL IAM auth use passwordless strings, but an external database DSN can carry a password, and it was written to the log on every restart. Log the parsed, non-secret parts instead: host, port, database, user, whether a password is set and whether TLS is on. pgconn.ParseConfig handles both the URI and the libpq key=value forms, so no string rewriting is needed and nothing is echoed. A string that does not parse is logged as "<unparseable>"; connectStore still reports the real error. Fixes agent-substrate#1832 > It's a good idea to open an issue first for discussion. - [x] Tests pass - [x] Appropriate changes to documentation are included in the PR (cherry picked from commit 38b9522)
Quentin Bisson (QuentinBisson)
added a commit
to giantswarm/substrate
that referenced
this pull request
Oct 8, 2026
Quentin Bisson (QuentinBisson)
pushed a commit
to giantswarm/substrate
that referenced
this pull request
Oct 8, 2026
…t contain db password) at startup (agent-substrate#1833) logFlagValues writes every flag to the log when the server starts, and that included --postgres-connection-string verbatim. The bundled database and Cloud SQL IAM auth use passwordless strings, but an external database DSN can carry a password, and it was written to the log on every restart. Log the parsed, non-secret parts instead: host, port, database, user, whether a password is set and whether TLS is on. pgconn.ParseConfig handles both the URI and the libpq key=value forms, so no string rewriting is needed and nothing is echoed. A string that does not parse is logged as "<unparseable>"; connectStore still reports the real error. Fixes agent-substrate#1832 > It's a good idea to open an issue first for discussion. - [x] Tests pass - [x] Appropriate changes to documentation are included in the PR (cherry picked from commit 38b9522)
Quentin Bisson (QuentinBisson)
added a commit
to giantswarm/substrate
that referenced
this pull request
Oct 8, 2026
1 of 4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
logFlagValues writes every flag to the log when the server starts, and that included --postgres-connection-string verbatim. The bundled database and Cloud SQL IAM auth use passwordless strings, but an external database DSN can carry a password, and it was written to the log on every restart.
Log the parsed, non-secret parts instead: host, port, database, user, whether a password is set and whether TLS is on. pgconn.ParseConfig handles both the URI and the libpq key=value forms, so no string rewriting is needed and nothing is echoed. A string that does not parse is logged as ""; connectStore still reports the real error.
Fixes #1832