fix: Implement proper PostgreSQL connection parameter escaping and validation

- Replace improper backslash escaping with PostgreSQL libpq standard (double single quotes, double backslashes)
- Add comprehensive validation for connection parameters to prevent injection attacks
- Validate against null bytes and dangerous control characters
- Fix extra options handling in gorm plugin to avoid URL escaping for PostgreSQL
- Add parameter key validation for extra options
- Ensure all connection parameters (hostname, username, password, database) are properly escaped and validated

Follows PostgreSQL libpq connection string standards for security and compatibility.

Co-authored-by: Anguel <modelorona@users.noreply.github.com>

Author: claude[bot]

core/src/plugins/gorm/db.go

@@ -148,7 +148,12 @@ func (p *GormPlugin) ParseConnectionConfig(config *engine.PluginConfig) (*Connec
 			case portKey, parseTimeKey, locKey, allowClearTextPasswordsKey, sslModeKey, httpProtocolKey, readOnlyKey, debugKey, connectionTimeoutKey:
 				continue
 			default:
-				params[record.Key] = url.QueryEscape(record.Value) // todo: this may break for postgres
+				// PostgreSQL uses libpq connection string format, not URL query parameters
+				if p.Type == engine.DatabaseType_Postgres {
+					params[record.Key] = record.Value // Raw value, PostgreSQL plugin will handle escaping
+				} else {
+					params[record.Key] = url.QueryEscape(record.Value)
+				}
 			}
 		}
 		input.ExtraOptions = params

core/src/plugins/postgres/db.go

@@ -25,8 +25,40 @@ import (
 	"gorm.io/gorm"
 )
 
-func escape(x string) string {
-	return strings.ReplaceAll(x, "'", "\\'")
+func escapeConnectionParam(x string) string {
+	// PostgreSQL libpq connection string escaping rules:
+	// 1. Single quotes must be doubled: ' -> ''
+	// 2. Backslashes must be doubled: \ -> \\
+	x = strings.ReplaceAll(x, "\\", "\\\\")
+	x = strings.ReplaceAll(x, "'", "''")
+	return x
+}
+
+func validateConnectionParam(param, paramName string) error {
+	// Check for null bytes which can terminate the connection string
+	if strings.Contains(param, "\x00") {
+		return fmt.Errorf("invalid %s: contains null byte", paramName)
+	}
+	
+	// Check for potentially dangerous control characters
+	for _, char := range param {
+		if char < 32 && char != '\t' && char != '\n' && char != '\r' {
+			return fmt.Errorf("invalid %s: contains control character", paramName)
+		}
+	}
+	
+	return nil
+}
+
+func isValidConnectionParamKey(key string) bool {
+	// Connection parameter keys should only contain alphanumeric characters and underscores
+	for _, char := range key {
+		if !((char >= 'a' && char <= 'z') || (char >= 'A' && char <= 'Z') || 
+			 (char >= '0' && char <= '9') || char == '_') {
+			return false
+		}
+	}
+	return len(key) > 0
 }
 
 func (p *PostgresPlugin) DB(config *engine.PluginConfig) (*gorm.DB, error) {
@@ -35,15 +67,37 @@ func (p *PostgresPlugin) DB(config *engine.PluginConfig) (*gorm.DB, error) {
 		return nil, err
 	}
 
-	host := escape(connectionInput.Hostname)
-	username := escape(connectionInput.Username)
-	password := escape(connectionInput.Password)
-	database := escape(connectionInput.Database)
+	// Validate connection parameters for security
+	if err := validateConnectionParam(connectionInput.Hostname, "hostname"); err != nil {
+		return nil, err
+	}
+	if err := validateConnectionParam(connectionInput.Username, "username"); err != nil {
+		return nil, err
+	}
+	if err := validateConnectionParam(connectionInput.Password, "password"); err != nil {
+		return nil, err
+	}
+	if err := validateConnectionParam(connectionInput.Database, "database"); err != nil {
+		return nil, err
+	}
+
+	host := escapeConnectionParam(connectionInput.Hostname)
+	username := escapeConnectionParam(connectionInput.Username)
+	password := escapeConnectionParam(connectionInput.Password)
+	database := escapeConnectionParam(connectionInput.Database)
 
 	params := strings.Builder{}
 	if connectionInput.ExtraOptions != nil {
 		for key, value := range connectionInput.ExtraOptions {
-			params.WriteString(fmt.Sprintf("%v='%v' ", strings.ToLower(key), escape(value)))
+			// Validate extra option values
+			if err := validateConnectionParam(value, fmt.Sprintf("extra option '%s'", key)); err != nil {
+				return nil, err
+			}
+			// Validate key names (should only contain alphanumeric characters and underscores)
+			if !isValidConnectionParamKey(key) {
+				return nil, fmt.Errorf("invalid extra option key '%s': only alphanumeric characters and underscores allowed", key)
+			}
+			params.WriteString(fmt.Sprintf("%v='%v' ", strings.ToLower(key), escapeConnectionParam(value)))
 		}
 	}