You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "Zhaohe-Ji (via GitHub)" <gi...@apache.org> on 2025/03/14 03:51:25 UTC
[I] special character in password of redshift like * cause create database failed [superset]
Zhaohe-Ji opened a new issue, #32664:
URL: https://github.com/apache/superset/issues/32664
### Bug description
1. login superset
2. click "+DATABASE"
3. choose PostgreSQL
4. enter host of redshift hostname and port 5439, user name and password BELYGmqy280*(contains a asterisk at the end, the password is auto-generated by redshift)
5. click "Connect" and error will show
-------------
Database Creation Error
We are unable to connect to your database. Click "See more" for database-provided information that may help troubleshoot the issue.
See more
6. click See more, will see "unable to create the database"
my superset version is apachesuperset.docker.scarf.sh/apache/superset:4.0.1
The error disappear when I change the password to one with no special character
### Screenshots/recordings
_No response_
### Superset version
4.0.2
### Python version
I don't know
### Node version
I don't know
### Browser
Chrome
### Additional context
_No response_
### Checklist
- [x] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [ ] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [ ] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] special character in password of redshift like * cause create database failed [superset]
Posted by "sfirke (via GitHub)" <gi...@apache.org>.
sfirke commented on issue #32664:
URL: https://github.com/apache/superset/issues/32664#issuecomment-2738027736
Agreed, specifically by https://github.com/apache/superset/pull/30532.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] special character in password of redshift like * cause create database failed [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #32664:
URL: https://github.com/apache/superset/issues/32664#issuecomment-2725264588
Can you check to see if this is happening in 4.1.1 or 5.0? We _think_ this got patched.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] special character in password of redshift like * cause create database failed [superset]
Posted by "CamiloCarvajalPensemos (via GitHub)" <gi...@apache.org>.
CamiloCarvajalPensemos commented on issue #32664:
URL: https://github.com/apache/superset/issues/32664#issuecomment-4984859119
I was able to reproduce this issue in Apache Superset 6.1.0.
The database password ends with an asterisk (`*`). The connection URI uses `%2A`, for example:
```text
postgresql://user:password%2A@host:5432/database
```
Observed behavior:
1. **Test Connection succeeds**.
2. After saving the database, loading schemas fails with:
```text
password authentication failed for user
```
3. The password stored in memory initially contains the trailing `*`, but after committing and reloading the `Database` model, the trailing `*` is gone.
Shell reproduction:
```python
database.set_sqlalchemy_uri(
"postgresql://user:password%2A@host:5432/database"
)
print(repr(database.password))
# 'password*'
db.session.commit()
db.session.expire_all()
database = db.session.get(Database, database.id)
print(repr(database.password))
# 'password'
```
The cause appears to be the encrypted column implementation:
```python
EncryptedType -> sqlalchemy_utils AesEngine -> NaivePadding
```
`NaivePadding` uses `*` as its padding character and removes padding with:
```python
value.rstrip(b"*")
```
As a result, any legitimate trailing asterisks in the password are removed during decryption.
A direct test confirms it:
```python
dialect = db.session.bind.dialect
encrypted = col.type.process_bind_param("test*", dialect)
col.type.process_result_value(encrypted, dialect)
# 'test'
```
This makes passwords ending in `*` unusable after the database configuration is persisted.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] special character in password of redshift like * cause create database failed [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #32664:
URL: https://github.com/apache/superset/issues/32664#issuecomment-2971901406
Assuming all is well here... closing, but happy to revisit.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] special character in password of redshift like * cause create database failed [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed issue #32664: special character in password of redshift like * cause create database failed
URL: https://github.com/apache/superset/issues/32664
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] special character in password of redshift like * cause create database failed [superset]
Posted by "ajunior (via GitHub)" <gi...@apache.org>.
ajunior commented on issue #32664:
URL: https://github.com/apache/superset/issues/32664#issuecomment-5256977755
We just hit the same problem here in v6.1.0. So, can we reopen this issue?
There's an old [fix](https://github.com/apache/superset/pull/4868) (closed without merge) linked with this [issue](https://github.com/apache/superset/issues/4826) that could solved it.
@aminghadersohi can you please take a look at this one or mention someone here who can help us with this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] special character in password of redshift like * cause create database failed [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #32664:
URL: https://github.com/apache/superset/issues/32664#issuecomment-2723353449
<!-- Greeting -->
Hello @Zhaohe-Ji! I'm a bot designed to help you with bug fixes, answer questions, and guide you on becoming a contributor. I'm here to assist you while you wait for a human maintainer.
<!-- Answer -->
I found a similar closed issue where a user faced a problem with special characters in the password for a database connection. The suggested workaround was to use `decoded_uri = DATABASE_URI.replace("%", "%%")` in line 45 of the `superset/migrations/env.py` file, which received positive feedback <sup>[[1]](https://github.com/apache/superset/issues/25501)</sup>.
Additionally, Superset uses an encoding or escaping mechanism for database URIs where colons are escaped with `\:` to prevent them from being interpreted as bindings to parameters <sup>[[2]](https://github.com/apache/superset/blob/master/superset/db_engine_specs/README.md)</sup>. This might be relevant if your password contains colons or other special characters that need escaping.
You might want to try similar encoding or escaping techniques for the asterisk in your password.
<!-- Dosu Comment Footer -->
*To continue talking to [Dosu](https://dosu.dev), mention @dosu.*
---
<sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/011c8ff3-e246-4071-af51-3e9001d325af?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/011c8ff3-e246-4071-af51-3e9001d325af?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/011c8ff3-e246-4071-af51-3e9001d325af?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/011c8ff3-e246-4071-af51-3e9001d325af?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/011c8ff3-e246-4071-af51-3e9001d325af?feedback_type=hallucination) | [Bug Report](https://app.dosu.dev/response-feedback/011c8ff3-e246-4071-af51-3e9001d325af?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/011c8ff3-e246-4071-af51-3e9001d325af?feedback_type=other)</sup>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] special character in password of redshift like * cause create database failed [superset]
Posted by "sadpandajoe (via GitHub)" <gi...@apache.org>.
sadpandajoe closed issue #32664: special character in password of redshift like * cause create database failed
URL: https://github.com/apache/superset/issues/32664
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] special character in password of redshift like * cause create database failed [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #32664:
URL: https://github.com/apache/superset/issues/32664#issuecomment-5258255299
Reopening, this is real and still happening, just a different root cause than what #30532 fixed. Confirmed independently: `Database.password` uses `EncryptedType` with the default `naive` padding scheme, which pads with `*` and unpads via `value.rstrip(b'*')`. Any password with a genuine trailing `*` gets stripped right along with the padding on the next read. Verified it directly against Superset's own field factory: `'mypassword*'` round-trips to `'mypassword'`. @CamiloCarvajalPensemos's diagnosis was exactly right.
Opened a TDD PR pinning this: #43074. The actual fix needs some care though, naive padding is sqlalchemy_utils' historical default, and switching padding schemes on an existing deployment has the same re-encryption hazard as the AES-CBC to AES-GCM engine switch already documented in `superset/utils/encrypt.py`. Old encrypted values could become unreadable if we just flip the default without a migration path. Probably worth scoping that as its own follow-up.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org