PostgreSQL Database object shows password in status when the connection string contains a non-valid character

[sdx-jkataja]

What happened?

PostgreSQL Database object shows password in status when the connection string contains a non-valid character

apiVersion: postgresql.sql.crossplane.io/v1alpha1
kind: Database
# metadata omitted
# spec omitted
status:
  conditions:
  - lastTransitionTime: "2025-09-01T15:34:28Z"
    message: 'observe failed: cannot select database: parse "postgres://app:dGhlc2UgYXJlIG5vdCB0aGUgcGFzd29yZHM=@app-rw.retracted\n:5432/postgres?sslmode=verify-full":
      net/url: invalid control character in URL'
    reason: ReconcileError

How can we reproduce it?

Add invalid character in URL, such as newline of base64 encoding of the value as I did here.

What environment did it happen in?

Crossplane version: xpkg.upbound.io/crossplane/crossplane:v1.19.0

Crossplane SQL version: xpkg.upbound.io/crossplane-contrib/provider-sql:v0.9.0