1
0
mirror of https://github.com/prometheus-community/postgres_exporter.git synced 2026-10-23 12:08:57 +03:00
Files
postgres_exporter/exporter/datasource.go
Joe Adams 322d6e60ec Redact DSN secrets from logged errors (#1409)
* Redact DSN secrets from logged errors

Errors from the URL parser and the pq driver quote the connection string
they were given, password included, and were logged verbatim alongside
the already-redacted dsn field. Add config.RedactError to strip the
password (including encoded forms and fragments of malformed key=value
values) from such errors, and apply it at every log site that handles a
DSN error in both the exporter and collector paths. Stop dsnFromURL and
parseFingerprint from echoing their input.

Fixes #1408

Signed-off-by: Joe Adams <github@joeadams.io>

* Remove copyright dates

Signed-off-by: Joe Adams <github@joeadams.io>

* Update redact for newline support

Signed-off-by: Joe Adams <github@joeadams.io>

---------

Signed-off-by: Joe Adams <github@joeadams.io>
2026-10-21 11:45:09 -03:00

180 lines
5.5 KiB
Go

// Copyright 2021 The Prometheus Authors
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package exporter
import (
"context"
"fmt"
"net/url"
"os"
"regexp"
"slices"
"strings"
"github.com/prometheus-community/postgres_exporter/config"
"github.com/prometheus/client_golang/prometheus"
)
func (e *Exporter) discoverDatabaseDSNs(ctx context.Context) []string {
// connstring syntax is complex (and not sure if even regular).
// we don't need to parse it, so just superficially validate that it starts
// with a valid-ish keyword pair
connstringRe := regexp.MustCompile(`^ *[a-zA-Z0-9]+ *= *[^= ]+`)
dsns := make(map[string]struct{})
for _, dsn := range e.dsn {
var dsnURI *url.URL
var dsnConnstring string
if strings.HasPrefix(dsn, "postgresql://") || strings.HasPrefix(dsn, "postgres://") {
var err error
dsnURI, err = url.Parse(dsn)
if err != nil {
e.logger.Error("Unable to parse DSN as URI", "dsn", loggableDSN(dsn), "err", config.RedactError(err, dsn))
continue
}
} else if connstringRe.MatchString(dsn) {
dsnConnstring = dsn
} else {
e.logger.Error("Unable to parse DSN as either URI or connstring", "dsn", loggableDSN(dsn))
continue
}
server, err := e.servers.GetServer(ctx, dsn)
if err != nil {
e.logger.Error("Error opening connection to database", "dsn", loggableDSN(dsn), "err", config.RedactError(err, dsn))
continue
}
dsns[dsn] = struct{}{}
// If autoDiscoverDatabases is true, set first dsn as master database (Default: false)
server.master = true
databaseNames, err := queryDatabases(ctx, server)
if err != nil {
e.logger.Error("Error querying databases", "dsn", loggableDSN(dsn), "err", config.RedactError(err, dsn))
continue
}
for _, databaseName := range databaseNames {
if slices.Contains(e.excludeDatabases, databaseName) {
continue
}
if len(e.includeDatabases) != 0 && !slices.Contains(e.includeDatabases, databaseName) {
continue
}
if dsnURI != nil {
dsnURI.Path = databaseName
dsn = dsnURI.String()
} else {
// replacing one dbname with another is complicated.
// just append new dbname to override.
dsn = fmt.Sprintf("%s dbname=%s", dsnConnstring, databaseName)
}
dsns[dsn] = struct{}{}
}
}
result := make([]string, len(dsns))
index := 0
for dsn := range dsns {
result[index] = dsn
index++
}
return result
}
func (e *Exporter) scrapeDSN(ctx context.Context, ch chan<- prometheus.Metric, dsn string) error {
server, err := e.servers.GetServer(ctx, dsn)
if err != nil {
return &ErrorConnectToServer{fmt.Sprintf("Error opening connection to database (%s): %s", loggableDSN(dsn), config.RedactError(err, dsn))}
}
// Check if autoDiscoverDatabases is false, set dsn as master database (Default: false)
if !e.autoDiscoverDatabases {
server.master = true
}
// Check if map versions need to be updated
if err := e.checkMapVersions(ctx, ch, server); err != nil {
e.logger.Warn("Proceeding with outdated query maps, as the Postgres version could not be determined", "err", config.RedactError(err, dsn))
}
return server.Scrape(ctx, ch)
}
// try to get the DataSource
// DATA_SOURCE_NAME always wins so we do not break older versions
// reading secrets from files wins over secrets in environment variables
// DATA_SOURCE_NAME > DATA_SOURCE_{USER|PASS}_FILE > DATA_SOURCE_{USER|PASS}
//
// Deprecated: cmd/postgres_exporter reads the --datasource.* flags instead and
// passes the DSNs to NewExporter; embedders should do the same. Removed in
// v0.22.0.
func GetDataSources() ([]string, error) {
var dsn = os.Getenv("DATA_SOURCE_NAME")
if len(dsn) != 0 {
return strings.Split(dsn, ","), nil
}
var user, pass, uri string
dataSourceUserFile := os.Getenv("DATA_SOURCE_USER_FILE")
if len(dataSourceUserFile) != 0 {
fileContents, err := os.ReadFile(dataSourceUserFile)
if err != nil {
return nil, fmt.Errorf("failed loading data source user file %s: %s", dataSourceUserFile, err.Error())
}
user = strings.TrimSpace(string(fileContents))
} else {
user = os.Getenv("DATA_SOURCE_USER")
}
dataSourcePassFile := os.Getenv("DATA_SOURCE_PASS_FILE")
if len(dataSourcePassFile) != 0 {
fileContents, err := os.ReadFile(dataSourcePassFile)
if err != nil {
return nil, fmt.Errorf("failed loading data source pass file %s: %s", dataSourcePassFile, err.Error())
}
pass = strings.TrimSpace(string(fileContents))
} else {
pass = os.Getenv("DATA_SOURCE_PASS")
}
ui := url.UserPassword(user, pass).String()
dataSrouceURIFile := os.Getenv("DATA_SOURCE_URI_FILE")
if len(dataSrouceURIFile) != 0 {
fileContents, err := os.ReadFile(dataSrouceURIFile)
if err != nil {
return nil, fmt.Errorf("failed loading data source URI file %s: %s", dataSrouceURIFile, err.Error())
}
uri = strings.TrimSpace(string(fileContents))
} else {
uri = os.Getenv("DATA_SOURCE_URI")
}
// No datasources found. This allows us to support the multi-target pattern
// without an explicit datasource.
if uri == "" {
return []string{}, nil
}
dsn = "postgresql://" + ui + "@" + uri
return []string{dsn}, nil
}