mirror of
				https://github.com/optim-enterprises-bv/vault.git
				synced 2025-10-31 02:28:09 +00:00 
			
		
		
		
	 3aed787786
			
		
	
	3aed787786
	
	
	
		
			
			The URL password redaction operation did not handle the case where the database connection URL was provided as a percent-encoded string, and its password component contained reserved characters. It attempted to redact the password by replacing the unescaped password in the percent-encoded URL. This resulted in the password being revealed when reading the configuration from Vault.
		
			
				
	
	
		
			75 lines
		
	
	
		
			1.7 KiB
		
	
	
	
		
			Go
		
	
	
	
	
	
			
		
		
	
	
			75 lines
		
	
	
		
			1.7 KiB
		
	
	
	
		
			Go
		
	
	
	
	
	
| package postgresql
 | |
| 
 | |
| import (
 | |
| 	"context"
 | |
| 	"database/sql"
 | |
| 	"fmt"
 | |
| 	"net/url"
 | |
| 	"os"
 | |
| 	"testing"
 | |
| 
 | |
| 	"github.com/hashicorp/vault/helper/testhelpers/docker"
 | |
| )
 | |
| 
 | |
| func PrepareTestContainer(t *testing.T, version string) (func(), string) {
 | |
| 	return prepareTestContainer(t, version, "secret", "database")
 | |
| }
 | |
| 
 | |
| func PrepareTestContainerWithPassword(t *testing.T, version, password string) (func(), string) {
 | |
| 	return prepareTestContainer(t, version, password, "database")
 | |
| }
 | |
| 
 | |
| func prepareTestContainer(t *testing.T, version, password, db string) (func(), string) {
 | |
| 	if os.Getenv("PG_URL") != "" {
 | |
| 		return func() {}, os.Getenv("PG_URL")
 | |
| 	}
 | |
| 
 | |
| 	if version == "" {
 | |
| 		version = "11"
 | |
| 	}
 | |
| 
 | |
| 	runner, err := docker.NewServiceRunner(docker.RunOptions{
 | |
| 		ImageRepo: "postgres",
 | |
| 		ImageTag:  version,
 | |
| 		Env: []string{
 | |
| 			"POSTGRES_PASSWORD=" + password,
 | |
| 			"POSTGRES_DB=" + db,
 | |
| 		},
 | |
| 		Ports: []string{"5432/tcp"},
 | |
| 	})
 | |
| 	if err != nil {
 | |
| 		t.Fatalf("Could not start docker Postgres: %s", err)
 | |
| 	}
 | |
| 
 | |
| 	svc, err := runner.StartService(context.Background(), connectPostgres(password))
 | |
| 	if err != nil {
 | |
| 		t.Fatalf("Could not start docker Postgres: %s", err)
 | |
| 	}
 | |
| 
 | |
| 	return svc.Cleanup, svc.Config.URL().String()
 | |
| }
 | |
| 
 | |
| func connectPostgres(password string) docker.ServiceAdapter {
 | |
| 	return func(ctx context.Context, host string, port int) (docker.ServiceConfig, error) {
 | |
| 		u := url.URL{
 | |
| 			Scheme:   "postgres",
 | |
| 			User:     url.UserPassword("postgres", password),
 | |
| 			Host:     fmt.Sprintf("%s:%d", host, port),
 | |
| 			Path:     "postgres",
 | |
| 			RawQuery: "sslmode=disable",
 | |
| 		}
 | |
| 
 | |
| 		db, err := sql.Open("postgres", u.String())
 | |
| 		if err != nil {
 | |
| 			return nil, err
 | |
| 		}
 | |
| 		defer db.Close()
 | |
| 
 | |
| 		err = db.Ping()
 | |
| 		if err != nil {
 | |
| 			return nil, err
 | |
| 		}
 | |
| 		return docker.NewServiceURL(u), nil
 | |
| 	}
 | |
| }
 |