Issue #21147: sqlite3 now raises an exception if the request contains a null

character instead of truncate it.  Based on patch by Victor Stinner.

diff --git a/Lib/sqlite3/test/regression.py b/Lib/sqlite3/test/regression.py
index 5b7759c9963dfec9efa4f7076d7372b79357c1a8..72c9277b7c134ee397d03aee79074746404057af 100644 (file)
--- a/Lib/sqlite3/test/regression.py
+++ b/Lib/sqlite3/test/regression.py
@@ -319,6 +319,16 @@ class RegressionTests(unittest.TestCase):
                           sqlite.connect, ":memory:", isolation_level=123)
 
 
+    def CheckNullCharacter(self):
+        # Issue #21147
+        con = sqlite.connect(":memory:")
+        self.assertRaises(ValueError, con, "\0select 1")
+        self.assertRaises(ValueError, con, "select 1\0")
+        cur = con.cursor()
+        self.assertRaises(ValueError, cur.execute, " \0select 2")
+        self.assertRaises(ValueError, cur.execute, "select 2\0")
+
+
 def suite():
     regression_suite = unittest.makeSuite(RegressionTests, "Check")
     return unittest.TestSuite((regression_suite,))

diff --git a/Misc/NEWS b/Misc/NEWS
index 2b0ac047b136346823d5281e34f9baff895d5080..e5f8f76b156bf8cca771d071546e992966c89157 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -22,6 +22,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #21147: sqlite3 now raises an exception if the request contains a null
+  character instead of truncate it.  Based on patch by Victor Stinner.
+
 - Issue #21951: Fixed a crash in Tkinter on AIX when called Tcl command with
   empty string or tuple argument.
 

diff --git a/Modules/_sqlite/connection.c b/Modules/_sqlite/connection.c
index 7a8a5a1b19e9305fef9b4928eb8e8b058c485922..0ed196d0e39e034edc62b3fb835d0078c4d62928 100644 (file)
--- a/Modules/_sqlite/connection.c
+++ b/Modules/_sqlite/connection.c
@@ -1215,7 +1215,8 @@ PyObject* pysqlite_connection_call(pysqlite_Connection* self, PyObject* args, Py
         if (rc == PYSQLITE_TOO_MUCH_SQL) {
             PyErr_SetString(pysqlite_Warning, "You can only execute one statement at a time.");
         } else if (rc == PYSQLITE_SQL_WRONG_TYPE) {
-            PyErr_SetString(pysqlite_Warning, "SQL is of wrong type. Must be string or unicode.");
+            if (!PyErr_Occurred() || PyErr_ExceptionMatches(PyExc_TypeError))
+                PyErr_SetString(pysqlite_Warning, "SQL is of wrong type. Must be string or unicode.");
         } else {
             (void)pysqlite_statement_reset(statement);
             _pysqlite_seterror(self->db, NULL);

diff --git a/Modules/_sqlite/statement.c b/Modules/_sqlite/statement.c
index 7a7a60fb71ac072913468bca2320dbb3b6e7fdfc..edcebddf9ae36ba3bfb2ee295f69b097d5dd9773 100644 (file)
--- a/Modules/_sqlite/statement.c
+++ b/Modules/_sqlite/statement.c
@@ -74,12 +74,15 @@ int pysqlite_statement_create(pysqlite_Statement* self, pysqlite_Connection* con
         rc = PYSQLITE_SQL_WRONG_TYPE;
         return rc;
     }
+    sql_cstr = PyString_AsString(sql_str);
+    if (strlen(sql_cstr) != (size_t)PyString_GET_SIZE(sql_str)) {
+        PyErr_SetString(PyExc_ValueError, "the query contains a null character");
+        return PYSQLITE_SQL_WRONG_TYPE;
+    }
 
     self->in_weakreflist = NULL;
     self->sql = sql_str;
 
-    sql_cstr = PyString_AsString(sql_str);
-
     Py_BEGIN_ALLOW_THREADS
     rc = sqlite3_prepare(connection->db,
                          sql_cstr,