Database URL does not support plus sign in password

[matt-snider]

When a mysql password contains +, it appears to not be handled correctly.

I am encoding the password that I pass via --url so that + becomes %2B. I can see that after url.Parse() in main.go this gets converted back to +. The problem is that the mysql Driver calls url.QueryUnescape(), after which the + becomes a single space.

If I don't encode the +, url.Parse() leaves it as is, but url.QueryUnescape() converts it to a single space, as in the first case.

I've experimented with url.PathUnescape(), and when this is used, everything seems to work properly. It seems like this is a safe switch to make since the documentation says:

PathUnescape is identical to QueryUnescape except that it does not unescape '+' to ' ' (space).

I can see that this change was introduced in #76. @kriive care to weigh on this?

[kriive]

Thanks! As far as my opinion counts, I'm all in (I only contributed that fix to this project). It certainly does not make any sense to parse "+" chars to spaces. Make sure to add a test to cover this case, to avoid regressions in the future 😄

[amacneil]

Definitely looks like a bug - from memory, the mysql driver expects a plain password string (no percent encoding) which is why we unencode it, but converting + to space is obviously not correct.

I added a comment in #200. Thanks!