fix(redis): harden generated command arguments

Author: openai0229

chat2db-community-server/chat2db-community-plugins/chat2db-community-redis/src/main/java/ai/chat2db/plugin/redis/RedisSqlBuilder.java

@@ -39,6 +39,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
+import java.util.UUID;
 
 import static ai.chat2db.plugin.redis.util.RedisValueUtils.getRedisValue;
 
@@ -303,7 +304,7 @@ private void appendListOperation(StringBuilder script, String keyName, String op
                 // Positional delete so a later duplicate occurrence removes exactly the
                 // edited row: LSET idx <tombstone> then LREM 1 <tombstone>. Value-based
                 // LREM would always hit the FIRST duplicate instead.
-                String tombstone = "__chat2db_deleted__" + index;
+                String tombstone = "__chat2db_deleted__" + UUID.randomUUID();
                 script.append("LSET ").append(getRedisValue(keyName))
                         .append(RedisConstants.COMMAND_ARGUMENT_SEPARATOR).append(index)
                         .append(RedisConstants.COMMAND_ARGUMENT_SEPARATOR).append(getRedisValue(tombstone))
@@ -345,7 +346,8 @@ private void appendStringOperation(StringBuilder script, String keyName, String
 
     private void appendZAddCommand(StringBuilder script, String keyName, String score, String value) {
         script.append(RedisConstants.COMMAND_ZSET_ADD_PREFIX).append(getRedisValue(keyName))
-                .append(RedisConstants.COMMAND_ARGUMENT_SEPARATOR).append(score)
+                .append(RedisConstants.COMMAND_ARGUMENT_SEPARATOR)
+                .append(getRedisValue(StringUtils.defaultString(score)))
                 .append(RedisConstants.COMMAND_ARGUMENT_SEPARATOR)
                 .append(getRedisValue(StringUtils.defaultString(value)))
                 .append(SQLConstants.LINE_SEPARATOR);

chat2db-community-server/chat2db-community-plugins/chat2db-community-redis/src/main/java/ai/chat2db/plugin/redis/util/RedisValueUtils.java

@@ -3,18 +3,21 @@
 public class RedisValueUtils {
 
     public static String getRedisValue(String value) {
-        if(value == null) {
+        if (value == null) {
             return null;
         }
-        if(value.contains("\\")) {
+        if (value.indexOf('\0') >= 0 || value.indexOf('\r') >= 0 || value.indexOf('\n') >= 0) {
+            throw new IllegalArgumentException("Redis JDBC command arguments cannot contain NUL, CR, or LF");
+        }
+        if (value.contains("\\")) {
             value = value.replace("\\", "\\\\");
         }
-        if(value.contains("'")) {
+        if (value.contains("'")) {
             value = value.replace("'", "\\'");
         }
-        if(value.contains("\"")) {
+        if (value.contains("\"")) {
             value = value.replace("\"", "\\\"");
         }
-        return "'"+value+"'";
+        return "'" + value + "'";
     }
 }

chat2db-community-server/chat2db-community-plugins/chat2db-community-redis/src/test/java/ai/chat2db/plugin/redis/RedisSqlBuilderTest.java

@@ -96,7 +96,7 @@ void buildByQueryResultGeneratesZSetMutationCommands() {
                         operation("DELETE", List.of("2", "w", "2.0"), null)),
                 new HashMap<>());
 
-        assertEquals("MULTI \n" + "ZADD 'k' 1.5 'v'\n" + "ZREM 'k' 'w'\n" + "EXEC",
+        assertEquals("MULTI \n" + "ZADD 'k' '1.5' 'v'\n" + "ZREM 'k' 'w'\n" + "EXEC",
                 RedisSqlBuilder.getInstance().buildByQueryResult(queryResult));
     }
 
@@ -112,9 +112,17 @@ void buildByQueryResultGeneratesListMutationCommands() {
 
         // DELETE on row 1 is positional now (tombstone via LSET+LREM) so duplicate
         // values cannot remove the wrong occurrence.
-        assertEquals("MULTI \n" + "LSET 'k' 1 'b'\n" + "RPUSH 'k' 'c'\n"
-                        + "LSET 'k' 0 '__chat2db_deleted__0'\n" + "LREM 'k' 1 '__chat2db_deleted__0'\n" + "EXEC",
-                RedisSqlBuilder.getInstance().buildByQueryResult(queryResult));
+        String script = RedisSqlBuilder.getInstance().buildByQueryResult(queryResult);
+        String[] lines = script.split("\\n");
+
+        assertEquals("MULTI ", lines[0]);
+        assertEquals("LSET 'k' 1 'b'", lines[1]);
+        assertEquals("RPUSH 'k' 'c'", lines[2]);
+        String tombstone = lines[3].substring(lines[3].lastIndexOf(' ') + 1);
+        assertTrue(tombstone.matches("'__chat2db_deleted__[0-9a-f-]+'"));
+        assertEquals("LSET 'k' 0 " + tombstone, lines[3]);
+        assertEquals("LREM 'k' 1 " + tombstone, lines[4]);
+        assertEquals("EXEC", lines[5]);
     }
 
     @Test

chat2db-community-server/chat2db-community-plugins/chat2db-community-redis/src/test/java/ai/chat2db/plugin/redis/util/RedisValueUtilsTest.java

@@ -5,6 +5,7 @@
 import static ai.chat2db.plugin.redis.util.RedisValueUtils.getRedisValue;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 
 class RedisValueUtilsTest {
 
@@ -28,4 +29,11 @@ void escapesSingleQuote() {
     void returnsNullForNullInput() {
         assertNull(getRedisValue(null));
     }
+
+    @Test
+    void rejectsCharactersThatRedisJdbcSplitsBeforeQuoteParsing() {
+        assertThrows(IllegalArgumentException.class, () -> getRedisValue("first\nDEL other"));
+        assertThrows(IllegalArgumentException.class, () -> getRedisValue("first\rDEL other"));
+        assertThrows(IllegalArgumentException.class, () -> getRedisValue("first\0second"));
+    }
 }