common/log: redact --ethstats credentials in startup command log

[MysticRyuujin]

Summary

• The startup banner logs the full command line via log.RedactArgs(os.Args) in cmd/erigon/main.go. URLs, IP addresses, and --datadir are already redacted, but --ethstats was not — and its value has the form nodename:secret@host:port, so the ethstats username and password were being printed in the clear at every startup.
• This adds an --ethstats redaction following the same --datadir pattern (matches --ethstats=value, --ethstats value, and the single-dash variants), with tests.

Test plan

• go test ./common/log/v3/... (new TestRedactArgsEthstats plus existing tests pass)
• make lint (0 issues)

[Copilot]

Pull request overview

Adds redaction support for --ethstats in the startup command-line logging to prevent leaking ethstats credentials (nodename/secret/host) in logs.

Changes:

• Introduces an ethstats redaction regex and applies it in RedactString.
• Adds a new unit test verifying redaction for --ethstats in --flag=value, --flag value, and one single-dash form.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
common/log/v3/redact.go	Adds --ethstats pattern and redacts its value to <redacted-ethstats> in RedactString.
common/log/v3/redact_test.go	Adds TestRedactArgsEthstats to validate the new redaction behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

TestRedactArgsEthstats covers the single-dash form only for "-ethstats=". Since the redaction regex is intended to match both "-ethstats=" and "-ethstats " (space-separated), add a test case for the latter to prevent regressions in that supported format.

Suggested change

	// single-dash variant
	in3 := []string{"erigon", "-ethstats=mynode:supersecret@stats.example.com:443", "--chain=mainnet"}
	out3 := RedactArgs(in3)
	mustContain(t, out3, "-ethstats=<redacted-ethstats>")
	if strings.Contains(out3, "supersecret") {
	t.Fatalf("expected ethstats secret to be redacted, got: %s", out3)
	}
	// single-dash variants
	in3 := []string{"erigon", "-ethstats=mynode:supersecret@stats.example.com:443", "--chain=mainnet"}
	out3 := RedactArgs(in3)
	mustContain(t, out3, "-ethstats=<redacted-ethstats>")
	if strings.Contains(out3, "supersecret") {
	t.Fatalf("expected ethstats secret to be redacted, got: %s", out3)
	}
	if strings.Contains(out3, "mynode") {
	t.Fatalf("expected ethstats nodename to be redacted, got: %s", out3)
	}
	if strings.Contains(out3, "stats.example.com") {
	t.Fatalf("expected ethstats host to be redacted, got: %s", out3)
	}
	in4 := []string{"erigon", "-ethstats", "mynode:supersecret@stats.example.com:443", "--chain=mainnet"}
	out4 := RedactArgs(in4)
	mustContain(t, out4, "-ethstats <redacted-ethstats>")
	if strings.Contains(out4, "supersecret") {
	t.Fatalf("expected ethstats secret to be redacted, got: %s", out4)
	}
	if strings.Contains(out4, "mynode") {
	t.Fatalf("expected ethstats nodename to be redacted, got: %s", out4)
	}
	if strings.Contains(out4, "stats.example.com") {
	t.Fatalf("expected ethstats host to be redacted, got: %s", out4)
	}