fix: handle unescaped userinfo in postgres url (#11396)

* fix: handle unescaped userinfo in postgres url

* add tests

* fix tests

cli/server_internal_test.go

@@ -9,6 +9,7 @@ import (
 	"github.com/spf13/pflag"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/sloghuman"
@@ -296,3 +297,53 @@ func TestIsDERPPath(t *testing.T) {
 		})
 	}
 }
+
+func TestEscapePostgresURLUserInfo(t *testing.T) {
+	t.Parallel()
+
+	testcases := []struct {
+		input  string
+		output string
+		err    error
+	}{
+		{
+			input:  "postgres://coder:coder@localhost:5432/coder",
+			output: "postgres://coder:coder@localhost:5432/coder",
+			err:    nil,
+		},
+		{
+			input:  "postgres://coder:co{der@localhost:5432/coder",
+			output: "postgres://coder:co%7Bder@localhost:5432/coder",
+			err:    nil,
+		},
+		{
+			input:  "postgres://coder:co:der@localhost:5432/coder",
+			output: "postgres://coder:co:der@localhost:5432/coder",
+			err:    nil,
+		},
+		{
+			input:  "postgres://coder:co der@localhost:5432/coder",
+			output: "postgres://coder:co%20der@localhost:5432/coder",
+			err:    nil,
+		},
+		{
+			input:  "postgres://local host:5432/coder",
+			output: "",
+			err:    xerrors.New("parse postgres url: parse \"postgres://local host:5432/coder\": invalid character \" \" in host name"),
+		},
+	}
+	for _, tc := range testcases {
+		tc := tc
+		t.Run(tc.input, func(t *testing.T) {
+			t.Parallel()
+			o, err := escapePostgresURLUserInfo(tc.input)
+			require.Equal(t, tc.output, o)
+			if tc.err != nil {
+				require.Error(t, err)
+				require.EqualValues(t, tc.err.Error(), err.Error())
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}