$ characters in passwords are expanded as shell variables
Hi, there.
When using a database connection URL with a password containing $ followed by alphanumeric characters (e.g., $0, $test, $admin), vim-dadbod expands these as shell/environment variables, corrupting the password and causing connection failures.
Example
- Connection URL:
```
postgresql://myuser:SecureP%24ss%240rd@localhost:5432/mydb
```
- Expected decoded password:
```
SecureP$ss$0rd
```
- Actual decoded password (corrupted):
```
SecureP$ss/bin/bashrd
```
Note that `$0` was expanded to `/bin/bash`.
Error Message
```
psql: error: invalid integer value "SecureP$ss" for connection option "port"
```
The password corruption in this case causes `psql` to misparse the connection URL.
The problem seems to be in `autoload/db.vim`, the `s:expand_all()` function is called unconditionally on all URLs:
https://github.com/tpope/vim-dadbod/blob/e95afed23712f969f83b4857a24cf9d59114c2e6/autoload/db.vim#L68
I'm guessing this is to support what it says in the manual of the plugin:
```
Additionally, one can give:
* A Vim variable (e.g., g:foo, w:bar, t:baz, b:quux) or environment variable
(e.g., $DATABASE_URL) containing a URL.
```
So maybe it can be more selective about what should be expanded?
For now, I modified my local installation to avoid that expansion because I don't use it. That fixed my issue and I was able to connect to my postgresql database.
Cheers.
关闭于 2026-01-07 3 条评论