Redact password from query_options

to avoid leaking credentials in exceptions via #inspect

Closes brianmario#1049

lib/mysql2/client.rb

@@ -78,6 +78,10 @@ def initialize(opts = {})
  warn "============= END WARNING FROM mysql2 ========="
  end
 
+ # avoid logging sensitive data via #inspect
+ @query_options.delete(:password)
+ @query_options.delete(:pass)
+
  user = opts[:username] || opts[:user]
  pass = opts[:password] || opts[:pass]
  host = opts[:host] || opts[:hostname]

spec/mysql2/client_spec.rb

@@ -1173,4 +1173,23 @@ def run_gc
  it "should respond to #encoding" do
  expect(@client).to respond_to(:encoding)
  end
+
+ it "should not include the password in the output of #inspect" do
+ client_class = Class.new(Mysql2::Client) do
+ def connect(*args)
+ end
+ end
+
+ client = client_class.new(password: "secretsecret")
+
+ expect(client.inspect).not_to include("password")
+ expect(client.inspect).not_to include("secretsecret")
+
+ expect do
+ client = client_class.new(pass: "secretsecret")
+ end.to output(/WARNING/).to_stderr
+
+ expect(client.inspect).not_to include("pass")
+ expect(client.inspect).not_to include("secretsecret")
+ end
 end