Skip to content

Commit 9f22fff

Browse files
committed
Prevent sqlalchemy's lack of url encoding from leaking passwords
Switches away from using `str(engine_instance.engine)` for rendering connection strings, in order to prevent passwords containing characters such as `#` from leaking. The name of the segment will contain the password if this character is used, likely others as well. See: https://bugs.python.org/issue18140 and encode/database#145 The code in question is here: sqlalchemy/sqlalchemy/blob/aea28a9/lib/sqlalchemy/engine/url.py#L597-L630
1 parent d9fec7d commit 9f22fff

File tree

1 file changed

+1
-1
lines changed
  • aws_xray_sdk/ext/sqlalchemy_core

1 file changed

+1
-1
lines changed

aws_xray_sdk/ext/sqlalchemy_core/patch.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
def _sql_meta(engine_instance, args):
1515
try:
1616
metadata = {}
17-
url = urlparse(str(engine_instance.engine.url))
17+
url = urlparse(engine_instance.engine.render_as_string())
1818
# Add Scheme to uses_netloc or // will be missing from url.
1919
uses_netloc.append(url.scheme)
2020
if url.password is None:

0 commit comments

Comments
 (0)