From 0aa6562913cabefa050fb6f4ab7b1289cde45286 Mon Sep 17 00:00:00 2001 From: Serhiy Storchaka Date: Thu, 11 Sep 2014 13:27:19 +0300 Subject: [PATCH] Issue #21147: sqlite3 now raises an exception if the request contains a null character instead of truncate it. Based on patch by Victor Stinner. --- Lib/sqlite3/test/regression.py | 10 ++++++++++ Misc/NEWS | 3 +++ Modules/_sqlite/connection.c | 3 ++- Modules/_sqlite/statement.c | 7 +++++-- 4 files changed, 20 insertions(+), 3 deletions(-) diff --git a/Lib/sqlite3/test/regression.py b/Lib/sqlite3/test/regression.py index 5b7759c996..72c9277b7c 100644 --- a/Lib/sqlite3/test/regression.py +++ b/Lib/sqlite3/test/regression.py @@ -319,6 +319,16 @@ class RegressionTests(unittest.TestCase): sqlite.connect, ":memory:", isolation_level=123) + def CheckNullCharacter(self): + # Issue #21147 + con = sqlite.connect(":memory:") + self.assertRaises(ValueError, con, "\0select 1") + self.assertRaises(ValueError, con, "select 1\0") + cur = con.cursor() + self.assertRaises(ValueError, cur.execute, " \0select 2") + self.assertRaises(ValueError, cur.execute, "select 2\0") + + def suite(): regression_suite = unittest.makeSuite(RegressionTests, "Check") return unittest.TestSuite((regression_suite,)) diff --git a/Misc/NEWS b/Misc/NEWS index 2b0ac047b1..e5f8f76b15 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -22,6 +22,9 @@ Core and Builtins Library ------- +- Issue #21147: sqlite3 now raises an exception if the request contains a null + character instead of truncate it. Based on patch by Victor Stinner. + - Issue #21951: Fixed a crash in Tkinter on AIX when called Tcl command with empty string or tuple argument. diff --git a/Modules/_sqlite/connection.c b/Modules/_sqlite/connection.c index 7a8a5a1b19..0ed196d0e3 100644 --- a/Modules/_sqlite/connection.c +++ b/Modules/_sqlite/connection.c @@ -1215,7 +1215,8 @@ PyObject* pysqlite_connection_call(pysqlite_Connection* self, PyObject* args, Py if (rc == PYSQLITE_TOO_MUCH_SQL) { PyErr_SetString(pysqlite_Warning, "You can only execute one statement at a time."); } else if (rc == PYSQLITE_SQL_WRONG_TYPE) { - PyErr_SetString(pysqlite_Warning, "SQL is of wrong type. Must be string or unicode."); + if (!PyErr_Occurred() || PyErr_ExceptionMatches(PyExc_TypeError)) + PyErr_SetString(pysqlite_Warning, "SQL is of wrong type. Must be string or unicode."); } else { (void)pysqlite_statement_reset(statement); _pysqlite_seterror(self->db, NULL); diff --git a/Modules/_sqlite/statement.c b/Modules/_sqlite/statement.c index 7a7a60fb71..edcebddf9a 100644 --- a/Modules/_sqlite/statement.c +++ b/Modules/_sqlite/statement.c @@ -74,12 +74,15 @@ int pysqlite_statement_create(pysqlite_Statement* self, pysqlite_Connection* con rc = PYSQLITE_SQL_WRONG_TYPE; return rc; } + sql_cstr = PyString_AsString(sql_str); + if (strlen(sql_cstr) != (size_t)PyString_GET_SIZE(sql_str)) { + PyErr_SetString(PyExc_ValueError, "the query contains a null character"); + return PYSQLITE_SQL_WRONG_TYPE; + } self->in_weakreflist = NULL; self->sql = sql_str; - sql_cstr = PyString_AsString(sql_str); - Py_BEGIN_ALLOW_THREADS rc = sqlite3_prepare(connection->db, sql_cstr, -- 2.50.1