Skip to main content

redact_sql

ferrule_core::redact

Function redact_sql 

Source 
pub fn redact_sql(sql: &str) -> String
Expand description

Redact inline secrets from a SQL body, returning a scrubbed copy.

Replaces the secret literal in these idioms with ***, preserving the surrounding SQL structure:

  • PASSWORD '<lit>' / PASSWORD "<lit>" (Postgres role/user DDL)
  • IDENTIFIED BY '<lit>' / IDENTIFIED BY "<lit>" and IDENTIFIED BY <bareword> (Oracle / MySQL)
  • IDENTIFIED BY PASSWORD '<lit>' (MySQL hash form)
  • any embedded scheme://user:<pass>@host connection-URL literal

Keyword matching is case-insensitive. A SQL body with no recognised secret idiom is returned byte-identical to the input.