t8y2/dbx · error
invalid TDengine password
Error message
invalid TDengine password
What it means
In build_from_fields, the password is set with Url::set_password after the username. A failure there is surfaced as 'invalid TDengine password'. set_password fails only when the resulting URL is structurally invalid (e.g. a ':' inside the password, which breaks userinfo parsing), since most characters are percent-encoded automatically.
Source
Thrown at agents/drivers/tdengine/src/config.rs:60
.map(|segment| percent_decode_str(segment).decode_utf8_lossy().into_owned())
.unwrap_or_default();
Ok(BuiltDsn { value: url.into(), database })
}
fn build_from_fields(params: &ConnectParams) -> Result<Url> {
let scheme = if params.ssl { "wss" } else { "ws" };
let host = if params.host.trim().is_empty() { DEFAULT_HOST } else { params.host.trim() };
let port = if params.port == 0 { DEFAULT_PORT } else { params.port };
let username = if params.username.is_empty() { DEFAULT_USER } else { ¶ms.username };
let password = if params.password.is_empty() { DEFAULT_PASSWORD } else { ¶ms.password };
let mut url = Url::parse(&format!("{scheme}://{DEFAULT_HOST}:{port}/"))?;
if let Ok(address) = host.parse::<IpAddr>() {
url.set_ip_host(address).map_err(|_| anyhow::anyhow!("invalid TDengine host"))?;
} else {
url.set_host(Some(host)).map_err(|_| anyhow::anyhow!("invalid TDengine host"))?;
}
url.set_username(username).map_err(|_| anyhow::anyhow!("invalid TDengine username"))?;
url.set_password(Some(password)).map_err(|_| anyhow::anyhow!("invalid TDengine password"))?;
if !params.database.trim().is_empty() {
url.set_path(&format!("/{}", params.database.trim()));
}
Ok(url)
}
fn apply_connection_fields(url: &mut Url, params: &ConnectParams) -> Result<()> {
if url.username().is_empty() {
let username = if params.username.is_empty() { DEFAULT_USER } else { ¶ms.username };
url.set_username(username).map_err(|_| anyhow::anyhow!("invalid TDengine username"))?;
}
if url.password().is_none() {
let password = if params.password.is_empty() { DEFAULT_PASSWORD } else { ¶ms.password };
url.set_password(Some(password)).map_err(|_| anyhow::anyhow!("invalid TDengine password"))?;
}
if url.path().trim_matches('/').is_empty() && !params.database.trim().is_empty() {
url.set_path(&format!("/{}", params.database.trim()));
}View on GitHub (pinned to c0390bff16)
Solutions
- Remove any ':' or control characters from the password, or ensure the value is a valid single secret string.
- Verify username and password fields are not swapped in the config.
- Trim whitespace/newlines from the password before constructing ConnectParams.
Example fix
// before password: "taos:data".into() // embedded ':' breaks userinfo // after password: "taosdata".into()
Defensive patterns
Strategy: validation
Validate before calling
// Rust
fn is_valid_password(p: &str) -> bool {
!p.contains(':') && p.chars().all(|c| !c.is_control())
} Prevention
- Avoid ':' in passwords, or URL-encode credentials by placing them in the DSN userinfo.
- Verify username/password fields are not swapped in config.
- Trim secrets fetched from secret managers to strip trailing newlines.
When it happens
Trigger: Calling build_dsn with a ConnectParams.password containing characters that cannot form valid userinfo — chiefly an embedded ':' or control characters.
Common situations: Passwords copied from documentation that include a separator character, secrets manager values with embedded newlines, or password/username fields swapped so a username with ':' lands in the password slot.
Related errors
- invalid TDengine username
- invalid TDengine HTTP connection string
- Kerberos requires SSPI, credential cache, keytab, or princip
- ZooKeeper authentication failed
- Hive connection string must start with jdbc:hive2:// or hive
AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05).
Data as JSON: /api/errors/66e7d2a6d605b648.
Report an issue: GitHub.