Security: maskPasswordInJdbcUrl does not mask authority-embedded credentials (user:pass@host)

[lucianjohnhouse]

Summary

maskPasswordInJdbcUrl() in UtilityElf.java only masks query-parameter passwords but misses authority-embedded credentials in JDBC URLs.

Affected Code

UtilityElf.java:49,56-58:

private static final Pattern PASSWORD_MASKING_PATTERN = 
    Pattern.compile("([?&;][^&#;=]*[pP]assword=)[^&#;]*");

What it catches

jdbc:mysql://host/db?password=secret → jdbc:mysql://host/db?password= ✅

What it MISSES

jdbc:postgresql://admin:s3cret@db.internal:5432/prod → NOT masked ❌

The regex requires a leading [?&;] before the password parameter. Credentials in the user:pass@host URI authority are logged verbatim via HikariConfig.logConfiguration() at DEBUG level (line 1182) and DriverDataSource constructor logging.

Impact

When DEBUG logging is enabled, JDBC URLs with authority-embedded credentials leak to application logs.

Suggested Fix

Extend the regex to also match authority-embedded credentials, or use URI parsing to strip userinfo before logging.