添加链接
link管理
链接快照平台
  • 输入网页链接,自动生成快照
  • 标签化管理网页链接

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement . We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

I detected this issue when user input (sanitized for SQL-injection with knex) started causing postgres errors.

Here is a sample that reproduces this behavior

client.query('SELECT $1::text as message', ['Hello world\u0000!']);

Output:

(node:94484) UnhandledPromiseRejectionWarning: error: invalid byte sequence for encoding "UTF8": 0x00

Is this something we can detect/prevent/sanitize on driver level or should I sanitize all strings that touch text type in postgreSQL on application level? (probably using some cumbersome REGEXP). The knex guys suggested that I should contact you.

knex/knex#2284 (comment)

A text field in PostgreSQL cannot contain Unicode symbol \u0000. It is reserved by PostgreSQL to represent the end of the string internally.

You can however successfully use \u0001 and so on symbols, i.e. everything else.

And because of that, this library does not need to sanitize knowingly invalid SQL.

Thank you for such a quick answer!

What I ended up doing is replacing the byte '\x00' with null. The issue is that I am processing a stream of thousands of messages per minute and even though it's a tiny replacement it still adds up.

Can you expand on what you mean by a stricter validation on the application level?

Cheers!

I see - thanks!

I believe I am passing the parameter as a string - like so:

if (singleLoad[3] === '\x00') singleLoad[3] = null await client.query(text, singleLoad)

where text, singleLoad are:

const text =  "INSERT INTO trades(
  eventSymbol,
  eventTime,
  time,
  exchangeCode,
  price,
  change,
) VALUES($1, $2, $3, $4, $5, $6, $7)"
const singleLoad = [
  '.PINS230120C37',
  1600180827366,
  '\x00',

and the table was created like so:

CREATE TABLE trades (
  eventSymbol varchar(50),
  eventTime bigint,
  time bigint,
  exchangeCode bytea,
  price decimal,
  change decimal,
  size bigint

Would passing the parameter as buffer mean something like this?:
singleLoad[3] = new Buffer(singleLoad[3])
I was hoping to not do any computation in the process of inserting this data because its a lot of data coming very fast so it would take a toll - even if small - on the process.

Is there an option or parameter i can alter once so that i dont have to transform every inserted payload?