PostgreSQL Database object shows password in status when the connection string contains a non-valid character #266
Description
What happened?
PostgreSQL Database object shows password in status when the connection string contains a non-valid character
apiVersion: postgresql.sql.crossplane.io/v1alpha1
kind: Database
# metadata omitted
# spec omitted
status:
conditions:
- lastTransitionTime: "2025-09-01T15:34:28Z"
message: 'observe failed: cannot select database: parse "postgres://app:[email protected]\n:5432/postgres?sslmode=verify-full":
net/url: invalid control character in URL'
reason: ReconcileErrorHow can we reproduce it?
Add invalid character in URL, such as newline of base64 encoding of the value as I did here.
What environment did it happen in?
Crossplane version: xpkg.upbound.io/crossplane/crossplane:v1.19.0
Crossplane SQL version: xpkg.upbound.io/crossplane-contrib/provider-sql:v0.9.0