Also redact libpq 'password=' (e.g. inside pqopt) in logged conn strings

hide_password() only masked the ODBC 'PWD=' attribute, so a password
embedded in a libpq pqopt value (pqopt={... password=secret}) still
leaked into MyLog via szConnStrOut (drvconn.c) and via the per-attribute
logging in copyConnAttributes (dlg_specific.c).

Move hide_password() to misc.c so it can be shared, and teach it to mask
the libpq 'password=' keyword as well: the value is whitespace-delimited
(or single-quoted, honoring backslash escapes) and ends at the closing
brace of the pqopt block.  Use it to redact the pqopt value where
copyConnAttributes logs it, and skip the generic raw logging for that
key.  Non-secret pqopt fields (host, sslmode, application_name, ...)
remain visible for debugging.

Verified against PostgreSQL 18: ODBC PWD, unquoted pqopt password and
single-quoted pqopt password are all masked; no cleartext remains.

Author: davecramer

dlg_specific.c

@@ -687,9 +687,19 @@ copyConnAttributes(ConnInfo *ci, const char *attribute, const char *value)
 	}
 	else if (stricmp(attribute, INI_PQOPT) == 0 || stricmp(attribute, ABBR_PQOPT) == 0)
 	{
+		char	*hide_str = hide_password(value);
+
 		NULL_THE_NAME(ci->pqopt);
 		ci->pqopt_in_str = TRUE;
 		ci->pqopt = decode_or_remove_braces(value);
+		/*
+		 * A pqopt value can embed a libpq 'password=...', so log a copy
+		 * with the password masked and skip the generic logging below.
+		 */
+		MYLOG(0, "key='%s' value='%s'\n", attribute, hide_str ? hide_str : "");
+		if (hide_str)
+			free(hide_str);
+		printed = TRUE;
 	}
 	else if (stricmp(attribute, INI_UPDATABLECURSORS) == 0 || stricmp(attribute, ABBR_UPDATABLECURSORS) == 0)
 		ci->allow_keyset = pg_atoi(value);

drvconn.c

@@ -39,33 +39,6 @@
 
 #define	NULL_IF_NULL(a) (a ? a : "(NULL)")
 
-/*
- * Mask the password in a connection string before it is written to the log,
- * so that debug logs (MyLog/CommLog) can be shared without leaking the
- * database credentials.  Matches the PWD keyword case-insensitively.
- */
-static char * hide_password(const char *str)
-{
-	char *outstr, *pwdp;
-
-	if (!str)	return NULL;
-	outstr = strdup(str);
-	if (!outstr) return NULL;
-	for (pwdp = outstr; *pwdp; pwdp++)
-	{
-		if (strnicmp(pwdp, "PWD=", 4) == 0)
-			break;
-	}
-	if (*pwdp)
-	{
-		char	*p;
-
-		for (p=pwdp + 4; *p && *p != ';'; p++)
-			*p = 'x';
-	}
-	return outstr;
-}
-
 /* prototypes */
 static BOOL dconn_get_DSN_or_Driver(const char *connect_string, ConnInfo *ci);
 static BOOL dconn_get_connect_attributes(const char *connect_string, ConnInfo *ci);

misc.c

@@ -312,3 +312,59 @@ quote_table(const pgNAME schema, const pgNAME table, char *buf, int buf_size)
 
 	return buf;
 }
+
+/*
+ * Return a malloc'd copy of a connection string with any password value
+ * masked, so that debug logs (MyLog/CommLog) can be shared without leaking
+ * the database credentials.  Both keywords are matched case-insensitively:
+ *
+ *   PWD=       the ODBC password attribute; its value runs to the next ';'
+ *   password=  the libpq password keyword, e.g. inside a pqopt={...} value;
+ *              its value is whitespace-delimited (or single-quoted) and ends
+ *              at the closing brace of the pqopt block.
+ *
+ * The caller is responsible for free()ing the returned string.
+ */
+char *
+hide_password(const char *str)
+{
+	char	*outstr, *p;
+
+	if (!str)
+		return NULL;
+	outstr = strdup(str);
+	if (!outstr)
+		return NULL;
+	for (p = outstr; *p; )
+	{
+		if (strnicmp(p, "PWD=", 4) == 0)
+		{
+			for (p += 4; *p && *p != ';'; p++)
+				*p = 'x';
+		}
+		else if (strnicmp(p, "password=", 9) == 0)
+		{
+			p += 9;
+			if (*p == '\'')		/* libpq single-quoted value */
+			{
+				for (p++; *p && *p != '\''; p++)
+				{
+					if (*p == '\\' && p[1])
+						*p++ = 'x';
+					*p = 'x';
+				}
+				if (*p == '\'')
+					p++;
+			}
+			else
+			{
+				for (; *p && *p != ';' && *p != '}' &&
+				       *p != ' ' && *p != '\t'; p++)
+					*p = 'x';
+			}
+		}
+		else
+			p++;
+	}
+	return outstr;
+}

misc.h

@@ -98,6 +98,12 @@ FUNCTION_BEGIN_MACRO \
 FUNCTION_END_MACRO
 
 
+/*
+ * Return a malloc'd copy of a connection string with password values masked,
+ * for safe logging.  The caller must free() the result.
+ */
+char *hide_password(const char *str);
+
 #ifdef __cplusplus
 }
 #endif