Redact password from query_options

to avoid leaking credentials in exceptions via #inspect

Closes #1049

lib/mysql2/client.rb

@@ -78,6 +78,10 @@ def initialize(opts = {})
         warn "============= END WARNING FROM mysql2 ========="
       end
 
+      # avoid logging sensitive data via #inspect
+      @query_options.delete(:password)
+      @query_options.delete(:pass)
+
       user     = opts[:username] || opts[:user]
       pass     = opts[:password] || opts[:pass]
       host     = opts[:host] || opts[:hostname]

spec/mysql2/client_spec.rb

@@ -1173,4 +1173,23 @@ def run_gc
   it "should respond to #encoding" do
     expect(@client).to respond_to(:encoding)
   end
+
+  it "should not include the password in the output of #inspect" do
+    client_class = Class.new(Mysql2::Client) do
+      def connect(*args)
+      end
+    end
+
+    client = client_class.new(password: "secretsecret")
+
+    expect(client.inspect).not_to include("password")
+    expect(client.inspect).not_to include("secretsecret")
+
+    expect do
+      client = client_class.new(pass: "secretsecret")
+    end.to output(/WARNING/).to_stderr
+
+    expect(client.inspect).not_to include("pass")
+    expect(client.inspect).not_to include("secretsecret")
+  end
 end