Skip to content

aws-rds: Exclude caret (^) from allowed password pattern #35175

@moltar

Description

@moltar

Describe the bug

The exclusion list is maintained here:

/**
* The default set of characters we exclude from generated passwords for database users.
* It's a combination of characters that have a tendency to cause problems in shell scripts,
* some engine-specific characters (for example, Oracle doesn't like '@' in its passwords),
* and some that trip up other services, like DMS.
*
* This constant is private to the RDS module.
*/
export const DEFAULT_PASSWORD_EXCLUDE_CHARS = " %+~`#$&*()|[]{}:;<>?!'/@\"\\";

The caret (^) character is not allowed by Go's net/url parser and it will fail with:

net/url: invalid userinfo

Regression Issue

  • Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

N/A

Expected Behavior

The caret (^) character to be excluded.

Current Behavior

It is not excluded.

Reproduction Steps

N/A

Possible Solution

Exclude the character.

Additional Information/Context

I think this might break existing secrets as they will get regenerated, so it might need to be a feature flag for the future.

AWS CDK Library version (aws-cdk-lib)

2+

AWS CDK CLI version

N/A

Node.js Version

N/A

OS

N/A

Language

TypeScript

Language Version

N/A

Other information

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    @aws-cdk/aws-rdsRelated to Amazon Relational DatabasebugThis issue is a bug.effort/mediumMedium work item – several days of effortp2

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions