Connection string parse errors can include the password #22

Follow-up to #21, which stops one rejected-parameter error from echoing its value. While checking for other paths, I found three connection strings whose parse errors include part or all of the password.

What happens

A connection string that fails to parse can put the password into the exception message, and from there into logs and stack traces. This happens with a mistyped scheme and with a password that was not percent-encoded, which are both easy mistakes to make with a real password.

Reproducer

using Postgres

for dsn in (
    "postgresq://u:s3cr3t@h/db",         # scheme typo: parsed as a keyword string
    "postgresql://u:s3cr%zzt@h/db",      # bad percent-escape in the password
    "postgresql://u:s3cr/t@h/db",        # unescaped '/' in the password
)
    try
        Postgres.parse_dsn(dsn)
    catch e
        println(sprint(showerror, e))
    end
end

ArgumentError: connection parameter "postgresq://u:s3cr3t@h/db" is missing '='
URIs.ParseError("Invalid URI userinfo: u:s3cr%zzt")
URIs.ParseError("Invalid URI port: s3cr")

The first message comes from the keyword parser in connection_string.jl, and the other two come from URIs.URI.

libpq

libpq 16.15 does the same for all three inputs:

missing "=" after "postgresq://u:s3cr3t@h/db" in connection info string
invalid percent-encoded token: "s3cr%zzt"
invalid integer value "s3cr" for connection option "port"

The first two come from PQconninfoParse, and the third from PQconnectdb. So matching libpq here means leaking the password, and fixing it means departing from libpq's messages. I'm opening this as a question rather than a PR for that reason.

Versions

Julia 1.12.7 · Postgres.jl 2.2.2 (7ea62c9) · no server needed · Ubuntu 24.04

Possible direction

• Keyword parser: when the text before the missing = contains ://, report an invalid URI scheme instead of repeating the string.
• URI parser: catch the URIs.ParseError from URIs.URI and rethrow an ArgumentError that does not include the user info, for example "invalid PostgreSQL URI: could not parse the user info or port". The alternative is a fix in URIs.jl itself.

Happy to send a PR if either shape looks right to you, or to leave this as is if you prefer to keep the libpq wording.