Use raw string for PostgreSQL connection string

[jsf9k]

🗣 Description

This pull request modifies the Python code to use a raw string for the PostgreSQL connection string.

💭 Motivation and context

If the PostgreSQL password, for example, contains a literal backslash (\) character then we do not want it to be interpreted as the first character in a Python string escape sequence.

It is highly unlikely that anyone would choose a host name, database name, username, or password that genuinely contains special characters like \n, \t, etc.; therefore, it should be safe to treat all backslashes in the PostgreSQL connection string as literal backslashes.

🧪 Testing

All automated tests pass.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All new and existing tests pass.

✅ Pre-merge checklist

• Finalize version.

✅ Post-merge checklist

• Create a release.

[coveralls]

Pull Request Test Coverage Report for Build 13595302214

Details

• 2 of 2 (100.0%) changed or added relevant lines in 2 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 76.658%

---

Totals
Change from base Build 13591361643:	0.0%
Covered Lines:	226
Relevant Lines:	273

---

💛 - Coveralls

[dv4harr10]

Hi Shane @jsf9k , just one comment, in the src/guacscanner/guacscanner.py file the instances where cursor.execute(ENTITY_COUNT_QUERY, (entity_name, entity_type)) is used these are examples of string concatenation which is a possible vulnerability for SQL injection. What's your thoughts?

[jsf9k]

Hi Shane @jsf9k , just one comment, in the src/guacscanner/guacscanner.py file the instances where cursor.execute(ENTITY_COUNT_QUERY, (entity_name, entity_type)) is used these are examples of string concatenation which is a possible vulnerability for SQL injection. What's your thoughts?

In this project I think it's OK. The values being concatenated do not originate from users but from the AWS API, and the latter is a trusted source.