Skip to content

Commit

Permalink
f: don't quote parameterized passwords
Browse files Browse the repository at this point in the history
  • Loading branch information
proddata committed Feb 6, 2024
1 parent 50ea18e commit 41ae9e9
Showing 1 changed file with 2 additions and 3 deletions.
5 changes: 2 additions & 3 deletions crate/operator/update_user_password.py
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@
from kopf import TemporaryError
from kubernetes_asyncio.client import ApiException, CoreV1Api
from kubernetes_asyncio.stream import WsApiClient
from psycopg2.extensions import QuotedString

from crate.operator.config import config
from crate.operator.utils.formatting import b64decode
Expand Down Expand Up @@ -62,7 +61,7 @@ async def update_user_password(
no SSL/TLS is configured.
"""
scheme = "https" if has_ssl else "http"
password_quoted = QuotedString(b64decode(new_password)).getquoted().decode()
password = b64decode(new_password)

def get_curl_command(payload: dict) -> List[str]:
return [
Expand All @@ -82,7 +81,7 @@ def get_curl_command(payload: dict) -> List[str]:
command_alter_user = get_curl_command(
{
"stmt": 'ALTER USER "{}" SET (password = $1)'.format(username),
"args": [password_quoted],
"args": [password],
}
)
exception_logger = logger.exception if config.TESTING else logger.error
Expand Down

0 comments on commit 41ae9e9

Please sign in to comment.