Credentials passed as as url parameters are visible in log output

[dks0408070]

What did you do?

I set DATA_SOURCE_NAME with connection string providing user name and password as url parameters.
This is the format of my connection DATA_SOURCE_NAME string:
postgresql://:/?user=&password=

I populated the user and password parameters with invalid credentials. Bad password, etc.
Then I ran postgres_exporter application and loaded my 0.0.0.0/metrics endpoint

What did you expect to see?
In my logging output, I expected to see "PASSWORD REMOVED" in message text.

What did you see instead? Under which circumstances?
Instead the full password is logged.

I can work around this issue by changing my connection string to be formatted as
postgresql://:@:/

but it seems like loggableDSN() function should handle this condition as well.

• System information:

  Darwin 21.4.0 arm64

• postgres_exporter version:

  version 0.10.1

• postgres_exporter flags:

    --web.listen-address=":8080"
  

[sysadmind]

DSN sanitization for logging was fixed in #1104 (v0.17.0) and supporting PR #678. Please verify on a current release; closing as likely resolved but feel free to open a new issue if there is still something unresolved.

[ArthurSens]

I'm reopening since I still see this issue in current master

Reproduction steps:

Run exporter with

DATA_SOURCE_NAME='postgresql://localhost:1/postgres?user=test&password=FAKE_SECRET_123&sslmode=disable' ./postgres_exporter --web.listen-address=:9187

Scrape exporter

curl -s http://localhost:9187/metrics >/dev/null

See logs

time=2026-09-02T05:08:27.085+02:00 level=ERROR source=postgres_exporter.go:619 msg="error scraping dsn" err="Error opening connection to database (postgresql://localhost:1/postgres?user=test&password=FAKE_SECRET_123&sslmode=disable): dial tcp [::1]:1: connect: connection refused" dsn="postgresql://localhost:1/postgres?user=test&password=FAKE_SECRET_123&sslmode=disable"

I believe it happens only on failed connections, e.g. when the database is down