From ab301039ba0561c4758513cbf0481b2f776ee44d Mon Sep 17 00:00:00 2001 From: Cayce Date: Wed, 28 Oct 2026 21:10:47 +0000 Subject: [PATCH] =?UTF-8?q?fix(backup):=20log=20redaction=20leaked=20crede?= =?UTF-8?q?ntials=20=E2=80=94=20strip=20userinfo=20correctly?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous redaction (${PG_URL%%@*@}) never matched when the URL has a single @, so the full DSN (user:password@host) went to the log/journal. Now: scheme + ***:***@ + hostport/db only. Found during the point-3 E2E test; the leaked value in that transcript was the already-public test DB credential (itest probe DB). --- deploy/backup/make-backup.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/deploy/backup/make-backup.sh b/deploy/backup/make-backup.sh index 83ed87e..529c3f7 100755 --- a/deploy/backup/make-backup.sh +++ b/deploy/backup/make-backup.sh @@ -61,7 +61,9 @@ if [[ -z "$DB_URL" && -r "$ENV_FILE" ]]; then fi [[ -n "$DB_URL" ]] || die "no CAYCE_OPS_DATABASE_URL in env or $ENV_FILE" PG_URL="$(printf "%s" "$DB_URL" | sed -E "s#postgresql\+[a-z]+://#postgresql://#")" -log "dumping database from ${PG_URL%%@*@}***@..." +_scheme="${PG_URL%%://*}" +_hostpart="${PG_URL#**@}" +log "dumping database from ${_scheme}://***:***@${_hostpart}" pg_dump "$PG_URL" --format=custom --file "$TMP/cayce-ops-db.dump" encrypt "$TMP/cayce-ops-db.dump" "cayce-ops-db.dump.age" log "database dump: $(du -h "$TMP/cayce-ops-db.dump" | cut -f1) plaintext, encrypted ok"