fix: encode slashes in connection passwords

[zjn20030811]

Problem

Passwords containing / remain unescaped because urllib.parse.quote treats slashes as safe by default. In a PostgreSQL URL, this moves the configured database host into the parsed path and prevents the connection from reaching it.

Fix

Use an empty safe set in both connection-string parser copies so / is encoded as %2F.

Test plan

• Backend connection-string parser unit tests: 9 passed
• LFX connection-string parser regression test: 1 passed
• Ruff check and format check on all changed files

Summary by CodeRabbit

• Bug Fixes
  • Improved connection string handling by safely encoding reserved characters in database passwords.
  • Passwords containing slashes and similar characters now produce valid connection URLs while preserving the database hostname.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: f62cc35c-1130-4a9b-8401-7d36400aa019

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 08b95b98-940a-4a11-80b5-ea3777f2163c

📥 Commits

Reviewing files that changed from the base of the PR and between ca25384 and dd186b7.

📒 Files selected for processing (4)

• src/backend/base/langflow/utils/connection_string_parser.py
• src/backend/tests/unit/utils/test_connection_string_parser.py
• src/lfx/src/lfx/utils/connection_string_parser.py
• src/lfx/tests/unit/utils/test_connection_string_parser.py

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

Walkthrough

Changes

The connection string parsers now percent-encode all password characters. Unit tests verify slash encoding and hostname preservation in the backend test suite.

Connection Password Encoding

Layer / File(s)	Summary
Encode passwords and verify parsed URLs src/backend/base/langflow/utils/connection_string_parser.py, src/lfx/src/lfx/utils/connection_string_parser.py, src/backend/tests/unit/utils/test_connection_string_parser.py	Both parsers pass safe="" to quote. Tests verify that a slash becomes %2F and that the hostname remains db.example.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to dd186

The change consistently encodes slashes in connection passwords so they remain part of the password instead of being interpreted as URL path separators. No actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 8 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (8 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: encoding slash characters in connection-string passwords.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Test Coverage For New Implementations	✅ Passed	The PR includes regression coverage for both changed parser implementations. src/backend/tests/unit/utils/test_connection_string_parser.py adds `test_transform_connection_string_encodes_slash_in_pas…
Test Quality And Coverage	✅ Passed	PASS. The tests cover the changed behavior in both parser copies. The backend test checks the exact %2F output and preserves the parsed hostname, while the existing parameterized cases retain covera…
Test File Naming And Structure	✅ Passed	Both changed test files use the test_*.py pytest pattern and are located under tests/unit/utils. The root and LFX pytest configurations discover these files, and LFX automatically marks this direc…
Excessive Mock Usage Warning	✅ Passed	PASS: The changed tests use no mocks, patches, fakes, stubs, or spies. They directly call transform_connection_string and use the standard-library urlsplit for verification. The tests therefore do…

Full details: Test Coverage For New Implementations

Explanation

The PR includes regression coverage for both changed parser implementations. src/backend/tests/unit/utils/test_connection_string_parser.py adds test_transform_connection_string_encodes_slash_in_password, and src/lfx/tests/unit/utils/test_connection_string_parser.py adds the same focused test. Each test asserts / becomes %2F and verifies that db.example remains the parsed hostname. Both files follow the backend test_*.py naming convention, and the tests exercise the changed functionality rather than acting as placeholders.

Full details: Test Quality And Coverage

Explanation

PASS. The tests cover the changed behavior in both parser copies. The backend test checks the exact %2F output and preserves the parsed hostname, while the existing parameterized cases retain coverage for existing password handling. The LFX test checks the same exact output and hostname behavior. Both test directories are included in pytest configuration. Async and API endpoint criteria do not apply.

Full details: Test File Naming And Structure

Explanation

Both changed test files use the test_*.py pytest pattern and are located under tests/unit/utils. The root and LFX pytest configurations discover these files, and LFX automatically marks this directory as unit tests. Test names are descriptive, and each test uses direct assertions for the changed behavior. The backend file retains parameterized edge cases, while both files cover slash encoding and hostname preservation. No frontend or integration test change is present, and these pure-function tests need no setup or teardown.

Full details: Excessive Mock Usage Warning

Explanation

PASS: The changed tests use no mocks, patches, fakes, stubs, or spies. They directly call transform_connection_string and use the standard-library urlsplit for verification. The tests therefore do not obscure the core behavior or require replacement with integration tests under this check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}