MySQL Bugs: #74691: mysql_config_editor does not escape strings

Bug #74691	mysql_config_editor does not escape strings
Submitted:	5 Nov 2014 1:44	Modified:	12 Jan 2021 18:24
Reporter:	Andrew Dalgleish	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: Command-line Clients	Severity:	S3 (Non-critical)
Version:	1.0	OS:	Any
Assigned to:		CPU Architecture:	Any

Description:
The mysql_config_editor does not escape strings or enclose them in quotes.

When the strings are read, hash characters are treated as the start of a comment.
This causes problems if your password contains a hash character.

A workaround is to enter the password in quotes "pass#pass".

How to repeat:
$ mysql_config_editor set --host=host#host --user=user#user -p
Enter password: 
(Enter pass#pass)

$ my_print_defaults client
--user=msandbox
--password=msandbox
--port=5620
--socket=/tmp/mysql_sandbox5620.sock
--user=user
--password=pass
--host=host

$ mysql_config_editor set --host=host#host --user=user#user -p
Enter password: 
(Enter pass#pass)

$ my_print_defaults client
--user=msandbox
--password=msandbox
--port=5620
--socket=/tmp/mysql_sandbox5620.sock
--user=user
--password=pass
--host=host

Suggested fix:
Enclose all strings in quotes.

I encountered the same bug with: 

OS: Linux
MySQL version: MySQL Enterprise Edition 5.6.21
Utilities version: 1.5.2-1.el6 

Password with string "#" in it causes authentication failure.

This is apparently still happening on latest MySQL 5.7. Any plans to fix this?

See Bug#87107 for WB "Install Helper"s case.

This still occurs in the year 2020 on version 8.0.22.

Posted by developer:
 
Also note the fix for bug #29861961 that was pushed to  5.7.33, 8.0.23 and fixes the issue with "#" specifically.

Posted by developer:
 
Fixed in 8.0.24.

To enable use of spaces and other special characters within
configuration values, mysql_config_editor now surrounds values it
writes to the configuration file with double quote characters, and
also escapes double quote characters used within values.