Database traffic disclosure via dropped connection parameters

Cleartext transmission in pgsync before 0.6.7 allows man-in-the-middle attackers to read database traffic during schema sync. In SchemaSync#perform, the vulnerable code builds pg_dump and pg_restore commands as interpolated shell strings, causing URL query delimiters to be interpreted by the shell and dropping connection parameters after the first one. Exploitation requires an affected release to run --schema-first or --schema-only with a security-relevant parameter such as sslmode after another query parameter; the resulting database connection can proceed without the required transport encryption.