aws / aws-xray-sdk-go

AWS X-Ray SDK for the Go programming language.
Apache License 2.0
276 stars 117 forks source link

Password with equal sign (`=`) not stripped from keyword/value connection string #361

Open okonos opened 2 years ago

okonos commented 2 years ago

Example connection string:

user=db_user dbname=mydb password=my*passw?o=rd host=localhost port=5432 sslmode=disable timezone=UTC

No error is produced, the password is silently leaked into the segments.

If you happen to have stumbled upon this issue looking for solution, this can be worked around using URI format and escaping the password with net/url.PathEscape:

url := "postgres://db_user:" + url.PathEscape("my*passw?o=rd") + "@localhost:5432/mydb?sslmode=disable&timezone=UTC"