Does anyone know of a use case for using null bytes in CharField/TextField?
psycopg2 2.7+ raises ValueError("A string literal cannot contain NUL (0x00)
characters.") when trying to save null bytes [0] and this exception is
unhandled in Django which allow malicious form submissions to crash [1]. With
psycopg2 < 2.7, there is no exception and null bytes are silently truncated
by PostgreSQL. Other databases that I tested (SQLite, MySQL, Oracle) allow
saving null bytes. This creates possible cross-database compatibility
problems when moving data from those databases to PostgreSQL, e.g.[2].
I propose to have CharField and TextField strip null bytes from the value
either a) only on PostgreSQL or b) on all databases. Please indicate your
preference or suggest another solution.
[0] https://github.com/psycopg/psycopg2/issues/420
[1] https://code.djangoproject.com/ticket/28201 - Saving a Char/TextField
with psycopg2 2.7+ raises ValueError: A string literal cannot contain NUL
(0x00) characters is unhandled
[2] https://code.djangoproject.com/ticket/28117 - loaddata raises
ValueError with psycopg2 backend when data contains null bytes
--
You received this message because you are subscribed to the Google Groups
"Django developers (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
Visit this group at https://groups.google.com/group/django-developers.
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-developers/9897126d-b6ef-48f1-9f19-96ed98ce10e5%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
