From 12fca43fd27865568d75a9cd6d54af4be90f2651 Mon Sep 17 00:00:00 2001 From: Benjie Date: Thu, 19 Jan 2023 15:07:49 +0000 Subject: [PATCH 1/4] Escape \0 in identifiers and literals --- packages/pg/lib/client.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/packages/pg/lib/client.js b/packages/pg/lib/client.js index 82d571d8a..ce55694b7 100644 --- a/packages/pg/lib/client.js +++ b/packages/pg/lib/client.js @@ -444,7 +444,7 @@ class Client extends EventEmitter { // Ported from PostgreSQL 9.2.4 source code in src/interfaces/libpq/fe-exec.c escapeIdentifier(str) { - return '"' + str.replace(/"/g, '""') + '"' + return '"' + str.replace(/["\0]/g, '""') + '"' } // Ported from PostgreSQL 9.2.4 source code in src/interfaces/libpq/fe-exec.c @@ -459,6 +459,8 @@ class Client extends EventEmitter { } else if (c === '\\') { escaped += c + c hasBackslash = true + } else if (c === '\0') { + // Ignore it } else { escaped += c } From 3ceb90bf545c0130af3893614ebf22c622e45f1a Mon Sep 17 00:00:00 2001 From: Benjie Gillam Date: Sat, 11 Mar 2023 17:59:21 +0000 Subject: [PATCH 2/4] Bump From 2bb87d01da665e1fd462aec7e16371eab6136386 Mon Sep 17 00:00:00 2001 From: Benjie Gillam Date: Mon, 13 Mar 2023 08:14:17 +0000 Subject: [PATCH 3/4] Throw error on \0 --- packages/pg/lib/client.js | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/packages/pg/lib/client.js b/packages/pg/lib/client.js index ce55694b7..bccbf1bd1 100644 --- a/packages/pg/lib/client.js +++ b/packages/pg/lib/client.js @@ -444,7 +444,10 @@ class Client extends EventEmitter { // Ported from PostgreSQL 9.2.4 source code in src/interfaces/libpq/fe-exec.c escapeIdentifier(str) { - return '"' + str.replace(/["\0]/g, '""') + '"' + if (/\0/.test(str)) { + throw new Error("Identifier contains \\0 which is not allowed in PostgreSQL identifiers.") + } + return '"' + str.replace(/"/g, '""') + '"' } // Ported from PostgreSQL 9.2.4 source code in src/interfaces/libpq/fe-exec.c @@ -460,7 +463,7 @@ class Client extends EventEmitter { escaped += c + c hasBackslash = true } else if (c === '\0') { - // Ignore it + throw new Error("Literal contains \\0 which is not allowed in PostgreSQL strings."); } else { escaped += c } From 90309cdb43ae8d35114a0d43d435617d87ba8944 Mon Sep 17 00:00:00 2001 From: Benjie Date: Mon, 13 Mar 2023 10:15:05 +0000 Subject: [PATCH 4/4] Apply suggestions from code review Co-authored-by: Charmander <~@charmander.me> --- packages/pg/lib/client.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/pg/lib/client.js b/packages/pg/lib/client.js index bccbf1bd1..dc63928b7 100644 --- a/packages/pg/lib/client.js +++ b/packages/pg/lib/client.js @@ -444,8 +444,8 @@ class Client extends EventEmitter { // Ported from PostgreSQL 9.2.4 source code in src/interfaces/libpq/fe-exec.c escapeIdentifier(str) { - if (/\0/.test(str)) { - throw new Error("Identifier contains \\0 which is not allowed in PostgreSQL identifiers.") + if (str.includes('\0')) { + throw new Error('Identifier contains \\0, which is not allowed in PostgreSQL identifiers') } return '"' + str.replace(/"/g, '""') + '"' } @@ -463,7 +463,7 @@ class Client extends EventEmitter { escaped += c + c hasBackslash = true } else if (c === '\0') { - throw new Error("Literal contains \\0 which is not allowed in PostgreSQL strings."); + throw new Error('Literal contains \\0, which is not allowed in PostgreSQL strings') } else { escaped += c }