URL encode db username and password

Closes #4129
artifacthub · Nov 5, 2024 · 00eea73 · 00eea73
1 parent 927ac73
commit 00eea73
Show file tree

Hide file tree

Showing 5 changed files with 10 additions and 9 deletions.
diff --git a/charts/artifact-hub/Chart.yaml b/charts/artifact-hub/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: artifact-hub
 description: Artifact Hub is a web-based application that enables finding, installing, and publishing Cloud Native packages.
 type: application
-version: 1.20.0
+version: 1.21.0-0
 appVersion: 1.20.0
 kubeVersion: ">= 1.19.0-0"
 home: https://artifacthub.io

diff --git a/charts/artifact-hub/templates/hub_secret.yaml b/charts/artifact-hub/templates/hub_secret.yaml
@@ -15,8 +15,8 @@ stringData:
       host: {{ default (printf "%s-postgresql.%s" .Release.Name .Release.Namespace) .Values.db.host }}
       port: {{ .Values.db.port }}
       database: {{ .Values.db.database }}
-      user: {{ .Values.db.user }}
-      password: {{ .Values.db.password }}
+      user: {{ .Values.db.user | quote }}
+      password: {{ .Values.db.password | quote }}
     email:
       fromName: {{ .Values.email.fromName }}
       from: {{ .Values.email.from }}

diff --git a/charts/artifact-hub/templates/scanner_secret.yaml b/charts/artifact-hub/templates/scanner_secret.yaml
@@ -16,8 +16,8 @@ stringData:
       host: {{ default (printf "%s-postgresql.%s" .Release.Name .Release.Namespace) .Values.db.host }}
       port: {{ .Values.db.port }}
       database: {{ .Values.db.database }}
-      user: {{ .Values.db.user }}
-      password: {{ .Values.db.password }}
+      user: {{ .Values.db.user | quote }}
+      password: {{ .Values.db.password | quote }}
     creds:
       dockerUsername: {{ .Values.creds.dockerUsername }}
       dockerPassword: {{ .Values.creds.dockerPassword }}

diff --git a/charts/artifact-hub/templates/tracker_secret.yaml b/charts/artifact-hub/templates/tracker_secret.yaml
@@ -15,8 +15,8 @@ stringData:
       host: {{ default (printf "%s-postgresql.%s" .Release.Name .Release.Namespace) .Values.db.host }}
       port: {{ .Values.db.port }}
       database: {{ .Values.db.database }}
-      user: {{ .Values.db.user }}
-      password: {{ .Values.db.password }}
+      user: {{ .Values.db.user | quote }}
+      password: {{ .Values.db.password | quote }}
     creds:
       dockerUsername: {{ .Values.creds.dockerUsername }}
       dockerPassword: {{ .Values.creds.dockerPassword }}

diff --git a/internal/util/db.go b/internal/util/db.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"net/url"
 	"time"
 
 	"github.com/artifacthub/hub/internal/hub"
@@ -31,8 +32,8 @@ var (
 func SetupDB(cfg *viper.Viper) (*pgxpool.Pool, error) {
 	// Setup pool config
 	url := fmt.Sprintf("postgres://%s:%s@%s:%s/%s",
-		cfg.GetString("db.user"),
-		cfg.GetString("db.password"),
+		url.QueryEscape(cfg.GetString("db.user")),
+		url.QueryEscape(cfg.GetString("db.password")),
 		cfg.GetString("db.host"),
 		cfg.GetString("db.port"),
 		cfg.GetString("db.database"),