fix: reject empty ClickHouse TLS parameters

db/clickhouse.go

@@ -118,7 +118,7 @@ func ClickHouseOptions(raw string) (*clickhouse.Options, error) {
 	if _, ok := query["skip_verify"]; ok && !wantSecure {
 		return nil, fmt.Errorf("invalid CLICKHOUSE_URL: skip_verify requires clickhouses")
 	}
-	if value, ok := query["skip_verify"]; ok && value[0] != "" {
+	if value, ok := query["skip_verify"]; ok {
 		if _, err := strconv.ParseBool(value[0]); err != nil {
 			return nil, fmt.Errorf("invalid CLICKHOUSE_URL: skip_verify: %w", err)
 		}

db/clickhouse_test.go

@@ -77,6 +77,7 @@ func TestClickHouseOptionsRejectsInvalidDSN(t *testing.T) {
 		"clickhouse://localhost:9000/db?secure=true",
 		"clickhouses://localhost:9440/db?secure=false",
 		"clickhouses://localhost:9440/db?skip_verify=maybe",
+		"clickhouses://localhost:9440/db?skip_verify=",
 		"clickhouse://localhost:9000/db?skip_verify=true",
 		"https://localhost:9440/db",
 	}