]> git.ipfire.org Git - thirdparty/sqlalchemy/sqlalchemy.git/commit
Remove URL.__str__ causing a fallback to URL.__repr__
authorYassen Damyanov <yd@itlabs.bg>
Thu, 22 Sep 2022 09:05:00 +0000 (12:05 +0300)
committerYassen Damyanov <yd@itlabs.bg>
Thu, 22 Sep 2022 09:05:00 +0000 (12:05 +0300)
commitc6714433dbe5aa38a05620f759c7bfb0d797eed9
treeecc5dab46e6267e2e916843fd037809884c9f158
parent9ae645d5d1a8cc7732a6d335be6205d0b21e31b1
Remove URL.__str__ causing a fallback to URL.__repr__

Currently, careless uses of `str(engine.URL())` in logs and prints
can lead to leaking a clear text password to the open. Security wise
a better secrets handling approach would be to "Hide unless explicitly
told *not* to".

Remove `URL.__str__` which exposes the database password in clear.
`str(URL())` will then fall back to `URL.__repr__` which does censor
the password in its return value.

For cases when clear text password is indeed desired in the `URL()`
string representation, `URL.render_as_string(hide_password=False)` is
still available.
lib/sqlalchemy/engine/url.py
test/engine/test_parseconnect.py