fix: address CodeRabbit review — try-catch for malformed URIs, add / and ? tests

- Wrap decodeURIComponent(user) in try-catch to handle malformed percent
  sequences gracefully (falls back to encoding raw value)
- Add tests for / and ? in passwords
- Add test for malformed percent sequence in username
- Use test-prefixed values in all connection strings to avoid
  GitGuardian false positives

Co-Authored-By: Vijay Yadav <vijay@studentsucceed.com>

Author: VJ-yadav

packages/drivers/src/normalize.ts

@@ -158,8 +158,15 @@ export function sanitizeConnectionString(connectionString: string): string {
   const needsEncoding = /[@:#/?[\]%]/.test(password)
   if (!needsEncoding) return connectionString
 
-  // Re-encode both user and password to be safe
-  const encodedUser = encodeURIComponent(decodeURIComponent(user))
+  // Re-encode both user and password to be safe.
+  // decodeURIComponent can throw on malformed percent sequences — fall back to
+  // encoding the raw value if that happens.
+  let encodedUser: string
+  try {
+    encodedUser = encodeURIComponent(decodeURIComponent(user))
+  } catch {
+    encodedUser = encodeURIComponent(user)
+  }
   const encodedPassword = encodeURIComponent(password)
 
   return `${scheme}${encodedUser}:${encodedPassword}@${rest}`

packages/opencode/test/altimate/driver-normalize.test.ts

@@ -977,6 +977,25 @@ describe("sanitizeConnectionString", () => {
     expect(result).toBe("postgresql://testuser:t%40st%23v%3Aal@localhost:5432/testdb")
   })
 
+  test("encodes / in password", () => {
+    const input = "postgresql://testuser:test/val@localhost:5432/testdb"
+    const result = sanitizeConnectionString(input)
+    expect(result).toBe("postgresql://testuser:test%2Fval@localhost:5432/testdb")
+  })
+
+  test("encodes ? in password", () => {
+    const input = "postgresql://testuser:test?val@localhost:5432/testdb"
+    const result = sanitizeConnectionString(input)
+    expect(result).toBe("postgresql://testuser:test%3Fval@localhost:5432/testdb")
+  })
+
+  test("handles malformed percent sequence in username gracefully", () => {
+    const input = "postgresql://bad%ZZuser:t@st@localhost:5432/testdb"
+    const result = sanitizeConnectionString(input)
+    // Should not throw — falls back to encoding the raw username
+    expect(result).toContain("@localhost:5432/testdb")
+  })
+
   test("leaves already-encoded passwords untouched", () => {
     const input = "postgresql://testuser:t%40st%23val@localhost:5432/testdb"
     expect(sanitizeConnectionString(input)).toBe(input)