search

jackc / pgconn

MIT License
182 stars 87 forks source link

Parsing errors expose password #135

Closed 76creates closed 1 year ago

76creates commented 1 year ago

e.err.Error() can contain passwords on line: https://github.com/jackc/pgconn/blob/e82f7d1fadf5970c308d0502d196783e72467178/errors.go#L102

My password contained %S in it, could be useful for testing.

jackc commented 1 year ago

The error messages are redacted on a best effort basis. See redactPW. However, since the connection string could not be parsed it can only be on a best effort basis.

76creates commented 1 year ago

Fair enough, I will close this one, thanks!