cayce/cayce-ops
1
0
Fork 0
Code Issues 1 Pull Requests 25 Actions 5 Packages Projects Releases 2 Wiki Activity

fix(backup): log redaction leaked credentials — strip userinfo correctly
ci / lint-test-leaks (pull_request) Canceled after 0s
Details

Browse Source 
The previous redaction (${PG_URL%%@*@}) never matched when the URL has a
single @, so the full DSN (user:password@host) went to the log/journal.
Now: scheme + ***:***@ + hostport/db only.

Found during the point-3 E2E test; the leaked value in that transcript
was the already-public test DB credential (itest probe DB).
This commit is contained in:
cayce
2026-10-28 21:10:47 +00:00
parent b1dd5a4f98
commit ab301039ba
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/backup/make-backup.sh
+3 -1
View File
@@ -61,7 +61,9 @@ if [[ -z "$DB_URL" && -r "$ENV_FILE" ]]; then
fi
[[ -n "$DB_URL" ]] || die "no CAYCE_OPS_DATABASE_URL in env or $ENV_FILE"
PG_URL="$(printf "%s" "$DB_URL" | sed -E "s#postgresql\+[a-z]+://#postgresql://#")"
log "dumping database from ${PG_URL%%@*@}***@..."
_scheme="${PG_URL%%://*}"
_hostpart="${PG_URL#**@}"
log "dumping database from ${_scheme}://***:***@${_hostpart}"
pg_dump "$PG_URL" --format=custom --file "$TMP/cayce-ops-db.dump"
encrypt "$TMP/cayce-ops-db.dump" "cayce-ops-db.dump.age"
log "database dump: $(du -h "$TMP/cayce-ops-db.dump" | cut -f1) plaintext, encrypted ok"