Fix: Issue #1577. It is currently possible to leak information into logs from errors

pgjdbc/src/main/java/org/postgresql/Driver.java

@@ -56,6 +56,7 @@
  */
 public class Driver implements java.sql.Driver {
 
+  public static boolean logDetail = true;
   private static Driver registeredDriver;
   private static final Logger PARENT_LOGGER = Logger.getLogger("org.postgresql");
   private static final Logger LOGGER = Logger.getLogger("org.postgresql.Driver");
@@ -245,6 +246,10 @@ public Connection connect(String url, Properties info) throws SQLException {
       // Setup java.util.logging.Logger using connection properties.
       setupLoggerFromProperties(props);
 
+      if ( PGProperty.LOG_DETAIL.get(info).equalsIgnoreCase("false") ) {
+        logDetail = false;
+      }
+
       LOGGER.log(Level.FINE, "Connecting with URL: {0}", url);
 
       // Enforce login timeout, if specified, by running the connection

pgjdbc/src/main/java/org/postgresql/PGProperty.java

@@ -437,7 +437,10 @@ public enum PGProperty {
           + "to the database specified in the dbname parameter, "
           + "which will allow the connection to be used for logical replication "
           + "from that database. "
-          + "(backend >= 9.4)");
+          + "(backend >= 9.4)"),
+
+  LOG_DETAIL("log_detail", "true", "If set then the DETAIL information provided by the server is"
+    +       "included in the logs, if false the DETAIL information will be omitted");
 
   private final String name;
   private final String defaultValue;

pgjdbc/src/main/java/org/postgresql/util/ServerErrorMessage.java

@@ -80,7 +80,11 @@ public String getSeverity() {
   }
 
   public String getDetail() {
-    return mesgParts.get(DETAIL);
+    if (org.postgresql.Driver.logDetail == true) {
+      return mesgParts.get(DETAIL);
+    } else {
+      return "";
+    }
   }
 
   public String getHint() {

pgjdbc/src/test/java/org/postgresql/test/jdbc2/PGPropertyTest.java

@@ -27,6 +27,7 @@
 import java.beans.BeanInfo;
 import java.beans.Introspector;
 import java.beans.PropertyDescriptor;
+import java.sql.Connection;
 import java.sql.DriverPropertyInfo;
 import java.util.ArrayList;
 import java.util.Map;
@@ -291,4 +292,20 @@ public void testEncodedUrlValuesFromDataSource() {
     assertFalse("password", PGProperty.PASSWORD.isPresent(parsed));
     assertEquals("APPLICATION_NAME", applicationName, PGProperty.APPLICATION_NAME.get(parsed));
   }
+
+  @Test
+  public void testLogDetailFalse() throws Exception {
+    Properties props = new Properties();
+    PGProperty.USER.set(props,TestUtil.getUser());
+    PGProperty.PASSWORD.set(props, TestUtil.getPassword());
+    PGProperty.PG_DBNAME.set(props, TestUtil.getDatabase());
+    PGProperty.PG_HOST.set(props, TestUtil.getServer());
+    PGProperty.PG_PORT.set(props, TestUtil.getPort());
+    PGProperty.LOG_DETAIL.set(props,"false");
+
+    Connection con = TestUtil.openDB(props);
+
+    assertFalse(Driver.logDetail);
+
+  }
 }

pgjdbc/src/test/java/org/postgresql/test/jdbc2/ServerErrorTest.java

@@ -95,4 +95,43 @@ public void testDatatype() throws Exception {
     stmt.close();
   }
 
+  @Test
+  public void testLogDetail() throws Exception {
+    Statement stmt = con.createStatement();
+    stmt.executeUpdate("INSERT INTO testerr (id, val) VALUES (1, 1)");
+    try {
+      stmt.executeUpdate("INSERT INTO testerr (id, val) VALUES (1, 1)");
+      fail("Should have thrown a duplicate key exception.");
+    } catch (SQLException sqle) {
+      ServerErrorMessage err = ((PSQLException) sqle).getServerErrorMessage();
+      assertEquals("public", err.getSchema());
+      assertEquals("testerr", err.getTable());
+      assertEquals("testerr_pk", err.getConstraint());
+      assertEquals("Key (id)=(1) already exists.", err.getDetail());
+      assertNull(err.getDatatype());
+      assertNull(err.getColumn());
+    }
+    stmt.close();
+  }
+
+  @Test
+  public void testLogDetailFalse() throws Exception {
+    org.postgresql.Driver.logDetail = false;
+    Statement stmt = con.createStatement();
+    stmt.executeUpdate("INSERT INTO testerr (id, val) VALUES (1, 1)");
+    try {
+      stmt.executeUpdate("INSERT INTO testerr (id, val) VALUES (1, 1)");
+      fail("Should have thrown a duplicate key exception.");
+    } catch (SQLException sqle) {
+      ServerErrorMessage err = ((PSQLException) sqle).getServerErrorMessage();
+      assertEquals("public", err.getSchema());
+      assertEquals("testerr", err.getTable());
+      assertEquals("testerr_pk", err.getConstraint());
+      assertEquals("", err.getDetail());
+      assertNull(err.getDatatype());
+      assertNull(err.getColumn());
+    }
+    stmt.close();
+  }
+
 }