Do not enable mysql_clear_password by default

#1552 added support for the mysql_clear_password auth plugin, but made it enabled by default. Per the manual docs on it:

Sending passwords as cleartext may be a security problem in some configurations. To avoid problems if there is any possibility that the password would be intercepted, clients should connect to MySQL Server using a method that protects the password. Possibilities include SSL (see Section 6.3, “Using Encrypted Connections”), IPsec, or a private network.

To make inadvertent use of the mysql_clear_password plugin less likely, MySQL clients must explicitly enable it.

I would propose to make it disabled by default, and only enable it implicitly if the LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN environment variable is set to 1, Y or y (per the docs), or that a library consumer can add it themselves via config.authPlugins (following #1497 being merged to make it easy to reference).

[MasterOdin]

end to end test covering happy and error path. This is probably the most complicated step. I haven’t found an easy way to configure real mysql server with mysql_clear_password auth, possible option is to have mysql2.createServer server but not sure how much work is to have that running

Yeah, neither have I, without also configuring something like ldap alongside it. I agree the best option is to use mysql2.createServer. My plan was to base a test on one of:

• https://github.com/sidorares/node-mysql2/blob/master/test/integration/connection/test-connect-sha1.js
• https://github.com/sidorares/node-mysql2/blob/master/test/integration/test-auth-switch.js

I think this is shouldn’t be too bad, just haven’t yet found time, hoping to at some point this week.

[rathboma]

So as @sidorares suggested higher up the thread, adding a config parameter to createConnection or createPool sounds perfect.

mysql.createPool({
  enableCleartextPlugin: true
  ...
})
// this would be amazing