Redact MongoDB credentials in connection-string log line (closes #16)#29
Merged
Conversation
`MongoDBLoader.__init__` previously logged the full self.handle URI at INFO level, including the password embedded in the URL userinfo. This leaked the password to terminals, CI logs, Dagster job output, and any captured terminal scrollback. Log just `host:port/db` instead. The full URI is still stored on `self.handle` for use by linkml_store, but it no longer appears in human-readable output. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Prevents leaking MongoDB credentials by removing an INFO-level log line that printed the full MongoDB URI (including userinfo with username/password). This aligns with the loader’s operational needs (still constructing self.handle for linkml_store) while making runtime logs safe for terminals, CI, and Dagster output.
Changes:
- Replaced INFO logging of the full MongoDB connection string with a host/port/db-only log message.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
MongoDBLoader.__init__loggedf"MongoDB connection string: {self.handle}"at INFO level.self.handleis the full URI built byget_mongo_connection_string(), which embeds the username and password in the URL userinfo. So every loader run printed the password to:Discovered while running the loader earlier this session.
What
Log
host:port/dbonly. The full URI is still constructed and stored onself.handlefor use by linkml_store; it just no longer appears in human-readable log output.Verification
make teststill passes (11 passed, 8 skipped).Closes #16.