Logging connection string exposes credentials

[alkar]

When a DB connection cannot be established, https://github.com/wrouesnel/postgres_exporter/blob/master/postgres_exporter.go#L999 will log the connection string which includes username & password.

I'm not sure if there's any true value in logging that at all but if you want to log the connection string it'd be best to either mask the password or perhaps use url.Parse() and just log the extracted Host?

Happy to raise a PR for this. Thoughts?

[wrouesnel]

I think I explicitly recall doing this because we had some problem where it eventually turned out to be the password.

But yeah, there's no good reason to do it - if you want to raise a PR I'll accept - definitely my preference is parse and mask.

[alkar]

@wrouesnel thanks for the response. I've raised #58 so we can take the discussion there?

EDIT: I misread your message initially, will be adding some changes ASAP.

[wrouesnel]

Resolved by 12b95c4