I have recently realised that some error messages, in psycopg2, display the full database uri. This dbi’s credentials are obviously secret, and access to them is far more secure than the access to the logs.
psycopg2.OperationalError: connection to server at "my_database_uri.including_password.in_plain_text.com" (db_ip_address), port 5432 failed: FATAL: the database system is shutting down
I’m planning to catch the errors to obfuscate the error message, but is there a simpler way to do it?
0
You can override the error using error handling.
example :
import re
import logging
import psycopg2
try:
conn = psycopg2.connect(conn_string)
except psycopg2.OperationalError as e:
# Mask sensitive information from the exception message
error_message = re.sub(r"password=.*?s", "password=**** ", str(e))
logging.error("Database error: %s", error_message)