Unsafe DB password will fail urlsplit in DatabaseURL

[librehat]

url = 'postgres://username:[password@localhost:80/dbname'
DatabaseURL(url)  # an exception will be raised here from `urlsplit`

The root cause is the use of urllib.parse and the assumption that all components can be represented in the URL safe unquoted. As you can see, that is not always the case in real life (one of our servers has generated a password that has a [ but no ])

[librehat]

One simple patch I can think of right now is to treat all components potentially quoted, in which case the urlsplit method continues to work, but each component (username, password etc.) should be unquote in DatabaseURL. This change shouldn't break anything (unless % escaped characters are in fact expected password).

A more comprehensive change is to use keyword parameters to specify each component (username, password, etc.) instead of parsing a URL.

[lovelydinosaur]

Cross-linking to the convo on gitter... https://gitter.im/encode/community?at=5f720952417bf140aa1b47e5

[librehat]

URL implementation in httpx as a reference: https://github.com/encode/httpx/blob/32d37cfdf1697f0dbacbc2233ee34606369be87b/httpx/_models.py#L63

[librehat]

Do we know vaguely when we will see a new release of databases? 👀

[vmarkovtsev]

I am working on this right now. I wanted to merge as many PRs as possible before issuing a release.

[vmarkovtsev]

#255