Add automatic SCRAM-SHA-256 password escaping and comprehensive documentation #797

Copilot · 2025-09-11T23:07:06Z

Add automatic SCRAM-SHA-256 password escaping and comprehensive documentation
Address code scanning alerts for incomplete string escaping
Use nil_or_empty? function for password validation check as suggested in code review
Fix backslash escaping in SCRAM-SHA-256 password handling
Fix markdownlint issues in SCRAM-SHA-256 documentation

Changes

This PR addresses the SCRAM-SHA-256 password handling issue where $ characters in password hashes were being mangled during SQL execution, causing authentication failures.

Key improvements:

Automatic Detection: The cookbook detects passwords starting with SCRAM-SHA-256
Transparent Escaping: $ characters are automatically escaped as \$ to prevent shell interpretation
Proper Backslash Escaping: Fixed excessive backslash escaping from \\\\\\\\ to proper \\\\ for SQL safety
Backward Compatible: Only affects SCRAM-SHA-256 passwords; all other formats remain unchanged
Code Quality: Used existing nil_or_empty? utility function for cleaner password validation
Documentation Quality: Fixed all markdownlint issues for proper documentation formatting

Solution

Users can now simply write:

postgresql_role 'user1' do
  encrypted_password 'SCRAM-SHA-256$4096:salt$key:server'
  action [:create, :update]
end

The cookbook automatically escapes the password for safe SQL execution.

Testing

Verified that:

SCRAM-SHA-256 passwords are properly escaped (both $ and \ characters)
All existing password formats (MD5, plain text, etc.) remain unchanged
Integration test successfully creates users with SCRAM-SHA-256 passwords
Backslash escaping uses proper SQL escaping (not excessive escaping)
Documentation passes all markdownlint checks

Fixes #703.

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

…entation Co-authored-by: damacus <[email protected]>

libraries/sql/role.rb

…ng or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

libraries/sql/role.rb

…ng or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

libraries/sql/role.rb

bmhughes · 2025-09-14T17:22:22Z

libraries/sql/role.rb

        end

+        def escape_password_for_sql(password)
+          return password if password.nil? || password.empty?


@copilot Use nil_or_empty? function for this check

Updated to use nil_or_empty? function for the password check as suggested. The change replaces password.nil? || password.empty? with the more concise nil_or_empty?(password). Commit: 9e7b3d4

Co-authored-by: bmhughes <[email protected]>

bmhughes · 2025-09-14T17:30:37Z

libraries/sql/role.rb

+          # SCRAM-SHA-256 passwords contain $ characters that can be interpreted
+          # by shell or string processing. Escape them to prevent mangling.
+          if password.start_with?('SCRAM-SHA-256')
+            password.gsub('\\', '\\\\\\\\').gsub("'", "''").gsub('$', '\\$')


@copilot Update this to escape backslash characters please

Fixed the backslash escaping from excessive \\\\\\\\ (8 backslashes) to proper \\\\ (4 backslashes) for correct SQL escaping. Commit: 6b2f5c7

documentation/scram-sha-256.md

bmhughes · 2025-09-14T17:31:33Z

documentation/scram-sha-256.md

+## Password Format
+
+SCRAM-SHA-256 passwords have this specific format:
+```


@copilot Specific the code block language as ruby to statisfy markdownlink MD040

Specified code block language as text to satisfy markdownlint MD040. Commit: 623bf6e

bmhughes · 2025-09-14T17:31:39Z

documentation/scram-sha-256.md

+```
+
+Example:
+```


@copilot Specific the code block language as ruby to statisfy markdownlink MD040

Specified code block language as text to satisfy markdownlint MD040. Commit: 623bf6e

documentation/scram-sha-256.md

Changed from excessive \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ (8 backslashes) to proper \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ (4 backslashes) for SQL escaping. Each backslash in the original password is now correctly escaped as \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ (2 backslashes) in the result. Co-authored-by: bmhughes <[email protected]>

Co-authored-by: bmhughes <[email protected]>

github-actions · 2025-09-14T18:30:31Z

Slowest examples

Top 10 slowest examples (0.01 seconds, 51.45% of total time)

Example	Description	Time in seconds
spec/libraries/helpers_spec.rb:19	PostgreSQL::Cookbook::Helpers#data_dir(version) with rhel family and Postgres 11 from repo returns the correct path	0.01272
spec/libraries/role_spec.rb:70	PostgreSQL::Cookbook::SqlHelpers::Role #escape_password_for_sql with edge cases handles nil passwords	0.00318
spec/libraries/helpers_spec.rb:27	PostgreSQL::Cookbook::Helpers#data_dir(version) with rhel family and Postgres 11 from os returns the correct path	0.00039
spec/libraries/helpers_spec.rb:111	PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with debian family and Postgres 11 from repo returns the correct service name	0.00037
spec/libraries/helpers_spec.rb:57	PostgreSQL::Cookbook::Helpers#conf_dir(version) with rhel family and Postgres 11 from repo returns the correct path	0.00037
spec/libraries/helpers_spec.rb:119	PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with debian family and Postgres 15 from os returns the correct service name	0.00037
spec/libraries/helpers_spec.rb:43	PostgreSQL::Cookbook::Helpers#data_dir(version) with debian family and Postgres 11 from os returns the correct path	0.00034
spec/libraries/helpers_spec.rb:73	PostgreSQL::Cookbook::Helpers#conf_dir(version) with debian family and Postgres 14 from repo returns the correct path	0.00034
spec/libraries/helpers_spec.rb:119	PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with debian family and Postgres 12 from os returns the correct service name	0.00034
spec/libraries/helpers_spec.rb:81	PostgreSQL::Cookbook::Helpers#conf_dir(version) with debian family and Postgres 12 from os returns the correct path	0.00034

github-actions · 2025-09-14T18:30:31Z

Slowest examples

Top 10 slowest examples (0.01 seconds, 50.85% of total time)

Example	Description	Time in seconds
spec/libraries/helpers_spec.rb:19	PostgreSQL::Cookbook::Helpers#data_dir(version) with rhel family and Postgres 11 from repo returns the correct path	0.01233
spec/libraries/role_spec.rb:70	PostgreSQL::Cookbook::SqlHelpers::Role #escape_password_for_sql with edge cases handles nil passwords	0.00304
spec/libraries/helpers_spec.rb:111	PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with debian family and Postgres 15 from repo returns the correct service name	0.00035
spec/libraries/helpers_spec.rb:57	PostgreSQL::Cookbook::Helpers#conf_dir(version) with rhel family and Postgres 15 from repo returns the correct path	0.00035
spec/libraries/helpers_spec.rb:95	PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with rhel family and Postgres 12 from repo returns the correct service name	0.00035
spec/libraries/helpers_spec.rb:119	PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with debian family and Postgres 11 from os returns the correct service name	0.00034
spec/libraries/helpers_spec.rb:103	PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with rhel family and Postgres 11 from os returns the correct service name	0.00034
spec/libraries/helpers_spec.rb:27	PostgreSQL::Cookbook::Helpers#data_dir(version) with rhel family and Postgres 11 from os returns the correct path	0.00034
spec/libraries/helpers_spec.rb:19	PostgreSQL::Cookbook::Helpers#data_dir(version) with rhel family and Postgres 15 from repo returns the correct path	0.00034
spec/libraries/helpers_spec.rb:119	PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with debian family and Postgres 13 from os returns the correct service name	0.00034

damacus · 2025-09-15T16:02:38Z

This is ready to release. But I'm going to move it over to the new release workflow before releasing.

Initial plan

a7a620f

Copilot AI assigned Copilot and damacus Sep 11, 2025

Copilot started work on behalf of damacus September 11, 2025 23:07 View session

Add automatic SCRAM-SHA-256 password escaping and comprehensive docum…

b7551a6

…entation Co-authored-by: damacus <[email protected]>

github-advanced-security bot found potential problems Sep 11, 2025

View reviewed changes

libraries/sql/role.rb Fixed Show fixed Hide fixed

Copilot AI changed the title ~~[WIP] SCRAM-SHA-256 documentation~~ Add automatic SCRAM-SHA-256 password escaping and comprehensive documentation Sep 11, 2025

Copilot AI requested a review from damacus September 11, 2025 23:18

Copilot finished work on behalf of damacus September 11, 2025 23:18

Potential fix for code scanning alert no. 5: Incomplete string escapi…

e86ab3b

…ng or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

github-advanced-security bot found potential problems Sep 12, 2025

View reviewed changes

libraries/sql/role.rb Fixed Show fixed Hide fixed

damacus marked this pull request as ready for review September 14, 2025 16:16

damacus requested a review from a team as a code owner September 14, 2025 16:16

Potential fix for code scanning alert no. 6: Incomplete string escapi…

3d40e50

…ng or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

github-advanced-security bot found potential problems Sep 14, 2025

View reviewed changes

libraries/sql/role.rb Fixed Show fixed Hide fixed

bmhughes reviewed Sep 14, 2025

View reviewed changes

Copilot started work on behalf of bmhughes September 14, 2025 17:22 View session

Use nil_or_empty? function for password check in escape_password_for_sql

f588465

Co-authored-by: bmhughes <[email protected]>

Copilot AI requested a review from bmhughes September 14, 2025 17:26

Copilot finished work on behalf of bmhughes September 14, 2025 17:26

bmhughes previously approved these changes Sep 14, 2025

View reviewed changes

bmhughes added Bug Something isn't working Release: Patch Release to Chef Supermarket as a version patch when merged labels Sep 14, 2025

bmhughes reviewed Sep 14, 2025

View reviewed changes

Copilot started work on behalf of bmhughes September 14, 2025 17:30 View session

bmhughes reviewed Sep 14, 2025

View reviewed changes

documentation/scram-sha-256.md Show resolved Hide resolved

bmhughes reviewed Sep 14, 2025

View reviewed changes

documentation/scram-sha-256.md Show resolved Hide resolved

bmhughes reviewed Sep 14, 2025

View reviewed changes

documentation/scram-sha-256.md Show resolved Hide resolved

Copilot AI dismissed bmhughes’s stale review via f743322 September 14, 2025 17:40

Copilot AI requested a review from bmhughes September 14, 2025 17:40

Copilot finished work on behalf of bmhughes September 14, 2025 17:40

Copilot started work on behalf of bmhughes September 14, 2025 17:40 View session

Fix markdownlint issues in SCRAM-SHA-256 documentation

623bf6e

Co-authored-by: bmhughes <[email protected]>

Copilot finished work on behalf of bmhughes September 14, 2025 17:44

bmhughes approved these changes Sep 14, 2025

View reviewed changes

Uh oh!

Add automatic SCRAM-SHA-256 password escaping and comprehensive documentation #797

Are you sure you want to change the base?

Add automatic SCRAM-SHA-256 password escaping and comprehensive documentation #797

Uh oh!

Conversation

Copilot AI commented Sep 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Solution

Testing

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bmhughes Sep 14, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 14, 2025

Choose a reason for hiding this comment

Uh oh!

bmhughes Sep 14, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 14, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bmhughes Sep 14, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 14, 2025

Choose a reason for hiding this comment

Uh oh!

bmhughes Sep 14, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 14, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Sep 14, 2025

Slowest examples

Uh oh!

github-actions bot commented Sep 14, 2025

Slowest examples

Uh oh!

damacus commented Sep 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Sep 11, 2025 •

edited

Loading