wgtmac commented on code in PR #1067:
URL: https://github.com/apache/iceberg-cpp/pull/1067#discussion_r4422025606
##########
src/iceberg/catalog/sql/catalog_store_postgresql.cc:
##########
@@ -83,7 +83,8 @@ Result<std::shared_ptr<CatalogStore>>
MakePostgreSqlCatalogStore(
return std::make_shared<PostgresqlSingleCatalogStore>(options.catalog_name,
std::move(connection));
} catch (const std::exception& e) {
- return IOError("Failed to connect to PostgreSQL '{}': {}", options.uri,
e.what());
+ return IOError("Failed to connect to PostgreSQL '{}': {}",
+ RedactConnectionUri(options.uri), e.what());
Review Comment:
The URI is redacted, but `e.what()` is still treated as safe. With sqlpp23
0.69, a password containing whitespace is passed unquoted in libpq conninfo;
libpq can then include the following password fragment in its parse error.
Sanitize or replace the driver text, and add a factory-level regression test
using a password such as `secret fragment`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
