theory/dbix-connector — Issue #16: wrap $password in closure to help avoid disclosure
Author: bowman
Created: 2012-02-27 04:16:15+00:00
State: open

Rose::DB wraps passwords in a closure to make them a little less likely
to be dumped by accident:

http://code.google.com/p/rose/source/browse/trunk/modules/Rose-DB/lib/Rose/DB.pm#611

It seems like a nice idea. DBI itself seems to apply similar logic,
deleting Password from \%attr:

```
# attributes in DSN take precedence over \%attr connect parameter
$user = $attr->{Username} if defined $attr->{Username};
$pass = $attr->{Password} if defined $attr->{Password};
delete $attr->{Password}; # always delete Password as closure stores it securely
```

Would it be desirable and possible to add something to DBIx::Connector?
I noticed the password in a debug dump that contained $conn.

It looks like this feature would require some fiddling around with _args
to just hide the password, but wrapping the whole of _args is easy
(and passed the tests): https://gist.github.com/1921245

That wasn't too bad so I tried just allowing a wrapped password:
https://gist.github.com/1921289 (also passes test)

If either of these options look ok then I'm happy to add tests and docs
in a fork.

Brad