Documentation
¶
Overview ¶
Package sqlredact scrubs credential literals out of SQL statement text before that text reaches a log field, a span attribute, or an error message.
PostgreSQL's CREATE/ALTER ROLE ... PASSWORD '<literal>' and Oracle's CREATE/ALTER USER ... IDENTIFIED BY <password> take no bind parameter for the secret, so it never travels in args and the logger's SensitiveDataFilter, which masks by field NAME, cannot see it. Vendor scope is those two.
The rule never examines the credential: find the first credential keyword followed by a value, keep everything up to and including that keyword, and drop the whole remainder. Since the value always follows its keyword, every shape a matcher would have to understand — dollar quoting, prefixed constants, doubled quotes, Oracle's trailing REPLACE and BY VALUES, unterminated literals — is in the discarded tail. Over-redaction is the accepted cost: a keyword in front of something quote-shaped costs the statement its tail, and a delimiter opened before the keyword, such as the `(` of an OPTIONS list, is left unbalanced by design.
What is NOT scrubbed: a password inside a connection-string literal, as in CREATE SUBSCRIPTION ... CONNECTION 'host=h password=x' or a dblink argument. Qualifying on `=` would truncate ordinary DML such as UPDATE users SET password = crypt($1, gen_salt('bf')).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Statement ¶
Statement returns sql truncated at its first credential clause, with the value replaced by a fixed marker.
PASSWORD qualifies when the next byte past any whitespace or comment begins a value: a single quote, a dollar sign, or a letter introducing an E'…' / U&'…' constant. It does not qualify before `=`, `,`, `)`, `;`, end of input, or a bare word such as NULL or FROM, so DML naming a password column is untouched. IDENTIFIED qualifies when the next word is BY. Either keyword also qualifies when the gap behind it runs into an unterminated comment, since the value can no longer be located: this text reaches the log on the driver-error path, where malformed statements are exactly what arrives.
When nothing qualifies the input string itself is returned, unallocated. Callers must scrub BEFORE truncating for length: a length cut can remove the very keyword this rule depends on.
Types ¶
This section is empty.
Source Files