sanitize connection string for logging

src/pg2b3dm.database.tests/CommandLineArgumentSanitizerTests.cs

@@ -0,0 +1,50 @@
+namespace pg2b3dm.database.tests;
+
+public class CommandLineArgumentSanitizerTests
+{
+    [Test]
+    public void SanitizeForLogging_RedactsPasswordInConnectionString()
+    {
+        var args = new[]
+        {
+            "--connection",
+            "Host=db.example;Username=alice;Password=secret;Database=gis",
+            "-t",
+            "public.buildings"
+        };
+
+        var sanitized = CommandLineArgumentSanitizer.SanitizeForLogging(args);
+
+        Assert.That(sanitized, Is.EqualTo("--connection Host=db.example;Username=alice;Password=***;Database=gis -t public.buildings"));
+    }
+
+    [Test]
+    public void SanitizeForLogging_RedactsPwdAliasCaseInsensitively()
+    {
+        var args = new[]
+        {
+            "--connection",
+            "Host=db.example;Username=alice;PWD = secret;Database=gis"
+        };
+
+        var sanitized = CommandLineArgumentSanitizer.SanitizeForLogging(args);
+
+        Assert.That(sanitized, Is.EqualTo("--connection Host=db.example;Username=alice;PWD = ***;Database=gis"));
+    }
+
+    [Test]
+    public void SanitizeForLogging_LeavesNonPasswordArgumentsUnchanged()
+    {
+        var args = new[]
+        {
+            "--host",
+            "localhost",
+            "--dbname",
+            "gis"
+        };
+
+        var sanitized = CommandLineArgumentSanitizer.SanitizeForLogging(args);
+
+        Assert.That(sanitized, Is.EqualTo("--host localhost --dbname gis"));
+    }
+}

src/pg2b3dm/CommandLineArgumentSanitizer.cs

@@ -0,0 +1,16 @@
+using System.Linq;
+using System.Text.RegularExpressions;
+
+namespace pg2b3dm;
+
+public static partial class CommandLineArgumentSanitizer
+{
+    public static string SanitizeForLogging(string[] args)
+        => string.Join(" ", args.Select(Redact));
+
+    private static string Redact(string arg)
+        => PasswordRegex().Replace(arg, "$1***");
+
+    [GeneratedRegex(@"(\b(?:password|pwd)\s*=\s*)[^;]*", RegexOptions.IgnoreCase)]
+    private static partial Regex PasswordRegex();
+}

src/pg2b3dm/ConnectionStringResolver.cs

@@ -11,7 +11,7 @@ public static class ConnectionStringResolver
 {
     private const string DefaultHost = "localhost";
     private const string DefaultPort = "5432";
-    private const string ExampleCommand = "pg2b3dm --connection \"Host=localhost;Username=postgres;Database=postgres;Ssl Mode=Require;CommandTimeOut=0\" -t my_schema.my_table";
+    private const string ExampleCommand = "pg2b3dm --connection \"Host=localhost;Username=postgres;Database=postgres;CommandTimeOut=0\" -t my_schema.my_table";
     private static readonly string[] DeprecatedParameterOrder = ["--username", "--host", "--dbname", "--port"];
     private static readonly Dictionary<string, string> DeprecatedParameterAliases = new(StringComparer.OrdinalIgnoreCase)
     {

src/pg2b3dm/Program.cs

@@ -20,7 +20,7 @@ static void Main(string[] args)
     {
         var version = Assembly.GetEntryAssembly().GetName().Version;
         Console.WriteLine($"Tool: pg2b3dm {version}");
-        Console.WriteLine("Options: " + string.Join(" ", args));
+        Console.WriteLine("Options: " + CommandLineArgumentSanitizer.SanitizeForLogging(args));
         Parser.Default.ParseArguments<Options>(args).WithParsed(o => {
             // Octree checks 
             if(o.subdivisionScheme == SubdivisionScheme.OCTREE) {