SNOW-1247646: Mask truncated password less than 8 characters (#1906)

Author: sfc-gh-jdu

DESCRIPTION.md

@@ -26,6 +26,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Updated `write_pandas` to skip TABLE IF NOT EXISTS in truncate mode.
   - Improved cleanup logic for connection to rely on interpreter shutdown instead of the `__del__` method.
   - Updated the logging level from INFO to DEBUG when logging the executed query using `SnowflakeCursor.execute`.
+  - Fixed a bug that the truncated password in log is not masked.
 
 - v3.7.1(February 21, 2024)
 

src/snowflake/connector/secret_detector.py

@@ -48,7 +48,7 @@ class SecretDetector(logging.Formatter):
         r"(password"
         r"|pwd)"
         r"([\'\"\s:=]+)"
-        r"([a-z0-9!\"#\$%&\\\'\(\)\*\+\,-\./:;<=>\?\@\[\]\^_`\{\|\}~]{8,})",
+        r"([a-z0-9!\"#\$%&\\\'\(\)\*\+\,-\./:;<=>\?\@\[\]\^_`\{\|\}~]{1,})",
         flags=re.IGNORECASE,
     )
 

test/unit/test_log_secret_detector.py

@@ -171,6 +171,12 @@ def test_password():
     assert err_str is None
     assert masked_str == "pwd:****"
 
+    random_password_truncated = "password=Afs..."
+    masked, masked_str, err_str = SecretDetector.mask_secrets(random_password_truncated)
+    assert masked
+    assert err_str is None
+    assert masked_str == "password=****"
+
 
 def test_token_password():
     long_token = (