Skip to content

fix(db): do not log the database password - #204

Merged
dimoschi merged 1 commit into
mainfrom
fix/do-not-log-db-password
Oct 6, 2026
Merged

dimoschi merged 1 commit into
mainfrom
fix/do-not-log-db-password

Conversation

@dimoschi

@dimoschi dimoschi commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

Types of changes

  • Bugfix (non-breaking change which fixes an issue).
  • New feature (non-breaking change which adds functionality).
  • Breaking change (fix or feature that would cause existing functionality not to work as expected).
  • Documentation Update (if none of the other choices applies).

Proposed changes

src/database/session.py logged the full connection string at DEBUG, password included. It now logs the engine URL with repr(), which masks the password:

Database URL: mariadb+asyncmy://bot:***@localhost:3306/bot_dev?charset=utf8mb4

Checklist

  • I have read and followed the CONTRIBUTING.md
    doc.
  • Lint and unit tests pass locally with my changes.
  • I have added the necessary documentation (if appropriate).

Additional context

tests/src/database/test_session.py reloads the module with a known password and checks that it does not appear in the logs. It failed before the fix.

@dimoschi
dimoschi requested a review from makelarisjr as a code owner October 6, 2026 12:22
@codecov

codecov Bot commented Oct 6, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.17%. Comparing base (fe68e1c) to head (736eddb).

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #204   +/-   ##
=======================================
  Coverage   68.17%   68.17%           
=======================================
  Files          78       78           
  Lines        3702     3702           
=======================================
  Hits         2524     2524           
  Misses       1178     1178           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

The DEBUG log of the connection string included the password. It now logs the engine URL through repr(), which masks the password and keeps the driver, host and database.
@dimoschi
dimoschi force-pushed the fix/do-not-log-db-password branch from 8828a7f to 736eddb Compare October 6, 2026 12:31
@dimoschi
dimoschi merged commit af5d3f3 into main Oct 6, 2026
4 checks passed
@dimoschi
dimoschi deleted the fix/do-not-log-db-password branch October 6, 2026 12:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant