{"record":{"id":"88a130d3a8007504","repo":"golang-migrate/migrate","slug":"no-password","errorCode":null,"errorMessage":"no password","messagePattern":"no password","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"database/snowflake/snowflake.go","lineNumber":29,"sourceCode":"\t\"strings\"\n\t\"sync/atomic\"\n\n\t\"github.com/golang-migrate/migrate/v4/database\"\n\t\"github.com/lib/pq\"\n\tsf \"github.com/snowflakedb/gosnowflake\"\n)\n\nfunc init() {\n\tdb := Snowflake{}\n\tdatabase.Register(\"snowflake\", &db)\n}\n\nvar DefaultMigrationsTable = \"schema_migrations\"\n\nvar (\n\tErrNilConfig          = fmt.Errorf(\"no config\")\n\tErrNoDatabaseName     = fmt.Errorf(\"no database name\")\n\tErrNoPassword         = fmt.Errorf(\"no password\")\n\tErrNoSchema           = fmt.Errorf(\"no schema\")\n\tErrNoSchemaOrDatabase = fmt.Errorf(\"no schema/database name\")\n)\n\ntype Config struct {\n\tMigrationsTable string\n\tDatabaseName    string\n}\n\ntype Snowflake struct {\n\tisLocked atomic.Bool\n\tconn     *sql.Conn\n\tdb       *sql.DB\n\n\t// Open and WithInstance need to guarantee that config is never nil\n\tconfig *Config\n}\n","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/golang-migrate/migrate/blob/01a9643f1475e75bb6d6224ddeaf9d8e2434ca8a/database/snowflake/snowflake.go#L11-L47","documentation":"ErrNoPassword (message \"no password\") is returned by Snowflake's Open (snowflake.go:100-103) when the parsed URL has no password component: purl.User.Password() reports not-set. The driver builds a go-snowflake DSN that authenticates with user+password, so a passwordless URL cannot proceed. Note that a URL with only a username (snowflake://user@...) triggers this; a bare ':' with empty password may also fail here.","triggerScenarios":"Opening snowflake://user@account/schema/db without :password; env-var interpolation dropping the password; secrets stripped by an operator tool that redacts credentials.","commonSituations":"CI/CD secret injection removing special characters; DSNs copied from docs placeholders like snowflake://user:password@...; key-pair authentication setups where the operator assumed password auth is not needed.","solutions":["Include the password in the URL: snowflake://user:password@account/schema/database","If the password contains special characters, percent-encode them in the URL","Inject the password from a secret store instead of a hardcoded DSN, and verify the env var is actually set in the runtime","If using key-pair/SSO auth, this driver variant requires password auth — supply a password or extend the driver with a custom Config DSN path"],"exampleFix":"// before\nurl := os.Getenv(\"SNOWFLAKE_URL\") // snowflake://user@acct/PUBLIC/DB\n// after\nurl := fmt.Sprintf(\"snowflake://%s:%s@acct/PUBLIC/DB\", user, url.QueryEscape(password))","handlingStrategy":"validation","validationCode":"u, _ := url.Parse(dsn)\npw, ok := u.User.Password()\nif !ok || pw == \"\" {\n    return fmt.Errorf(\"snowflake DSN requires user:password credentials\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Include :password in the DSN; percent-encode special characters (e.g. @ -> %40)","Load credentials from a secret store and assert they are non-empty before startup","Test DSN parsing in CI with the same env-injection path used in production"],"tags":["go","golang-migrate","snowflake","config","authentication","credentials"],"backgroundTag":"missing-db-credentials","analyzedSha":"01a9643f1475e75bb6d6224ddeaf9d8e2434ca8a","analyzedAt":"2026-09-02T19:38:29.671Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}