cockroachdb / cockroach

CockroachDB — the cloud native, distributed SQL database designed for high availability, effortless scale, and control over data placement.
https://www.cockroachlabs.com
Other
29.9k stars 3.78k forks source link

Generated Passwords are not net/url (RFC 3986) safe #93499

Open punitarani opened 1 year ago

punitarani commented 1 year ago

The password generated for SQL Users contains characters that raise errors by net/url.

I encountered the issue while trying to use pgx.Connect. The generated password contained ] which raised net/url: invalid userinfo when trying to parseAuthority which uses validUserInfo to check the characters.

I was able to temporarily solve the problem by regenerating passwords to only include acceptable special characters.

I think it would be good to update the password charset to only include special characters that are considered safe according to RFC 3986.

Jira issue: CRDB-22367

blathers-crl[bot] commented 1 year ago

Hello, I am Blathers. I am here to help you get the issue triaged.

It looks like you have not filled out the issue in the format of any of our templates. To best assist you, we advise you to use one of these templates.

I have CC'd a few people who may be able to assist you:

If we have not gotten back to your issue within a few business days, you can try the following:

:owl: Hoot! I am a Blathers, a bot for CockroachDB. My owner is otan.

knz commented 1 year ago

@punitarani how did you generate the password? Was this in Cockroach Cloud? or somewhere else?

punitarani commented 1 year ago

@knz I believe it was the default password generated on Cockroach Cloud.