Language: Java
Label: vulnerable
CWE: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Code:
    ProcessExecutor createProcessExecutor(File targetDir, DbProperties dbProperties) {
        Properties connectionProperties = dbProperties.connectionProperties();
        Properties pgProperties = Driver.parseURL(dbProperties.url(), connectionProperties);

        ArrayList<String> argv = new ArrayList<>();
        LinkedHashMap<String, String> env = new LinkedHashMap<>();
        if (isNotBlank(dbProperties.password())) {
            env.put("PGPASSWORD", dbProperties.password());
        }

        // override with any user specified environment
        env.putAll(dbProperties.extraBackupEnv());

        String dbName = pgProperties.getProperty("PGDBNAME");
        argv.add("pg_dump");
        argv.add("--host=" + pgProperties.getProperty("PGHOST"));
        argv.add("--port=" + pgProperties.getProperty("PGPORT"));
        argv.add("--dbname=" + dbName);
        if (isNotBlank(dbProperties.user())) {
            argv.add("--username=" + dbProperties.user());
        }
        argv.add("--no-password");
        // append any user specified args for pg_dump
        if (isNotBlank(dbProperties.extraBackupCommandArgs())) {
            Collections.addAll(argv, Commandline.translateCommandline(dbProperties.extraBackupCommandArgs()));
        }
        argv.add("--file=" + new File(targetDir, "db." + dbName));
        ProcessExecutor processExecutor = new ProcessExecutor();
        processExecutor.redirectOutputAlsoTo(Slf4jStream.of(getClass()).asDebug());
        processExecutor.redirectErrorAlsoTo(Slf4jStream.of(getClass()).asDebug());
        processExecutor.environment(env);
        processExecutor.command(argv);
        return processExecutor;
    }