Skip to content

fix(cli): redact credentials from database URL console logs #626

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ymc9 merged 9 commits into from
Jan 30, 2026
Merged

fix(cli): redact credentials from database URL console logs #626

Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
fe799ee
feat(cli): add mysql support to proxy
ymc9 Jan 27, 2026
d1b7149
Initial plan
Copilot Jan 27, 2026
36ee595
fix: redact credentials from database URL logs
Copilot Jan 27, 2026
e9537a7
fix: also redact SQLite URLs for consistency
Copilot Jan 27, 2026
501ab33
Merge dev branch and remove SQLite URL redaction
Copilot Jan 30, 2026
6cba59c
docs: clean up merge conflicts by rebasing on correct base
Copilot Jan 30, 2026
6643175
Push new branch to create fresh PR
Copilot Jan 30, 2026
69cf57e
Merge remote-tracking branch 'origin/dev' into copilot/sub-pr-625
ymc9 Jan 30, 2026
2b85025
clean up agent mess
ymc9 Jan 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 18 additions & 2 deletions packages/cli/src/actions/proxy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,22 @@ function evaluateUrl(value: string): string {
}
}

function redactDatabaseUrl(url: string): string {
try {
const parsedUrl = new URL(url);
if (parsedUrl.password) {
parsedUrl.password = '***';
}
if (parsedUrl.username) {
parsedUrl.username = '***';
}
return parsedUrl.toString();
} catch {
// If URL parsing fails, return the original
return url;
}
}

function createDialect(provider: string, databaseUrl: string, outputPath: string) {
switch (provider) {
case 'sqlite': {
Expand All @@ -125,15 +141,15 @@ function createDialect(provider: string, databaseUrl: string, outputPath: string
});
}
case 'postgresql':
console.log(colors.gray(`Connecting to PostgreSQL database at: ${databaseUrl}`));
console.log(colors.gray(`Connecting to PostgreSQL database at: ${redactDatabaseUrl(databaseUrl)}`));
return new PostgresDialect({
pool: new PgPool({
connectionString: databaseUrl,
}),
});

case 'mysql':
console.log(colors.gray(`Connecting to MySQL database at: ${databaseUrl}`));
console.log(colors.gray(`Connecting to MySQL database at: ${redactDatabaseUrl(databaseUrl)}`));
Comment on lines +144 to +152
Copy link

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Redaction behavior is security-sensitive and currently untested. The repo has Vitest-based CLI tests (e.g., packages/cli/test/db.test.ts) but nothing covering proxy output; please add coverage that verifies logged connection strings never include raw credentials (including edge cases like special characters and query-param passwords).

Copilot uses AI. Check for mistakes.
return new MysqlDialect({
pool: createMysqlPool(databaseUrl),
});
Expand Down
Loading