I imagine we won't hear of a use case until after the change happens and I'm some what strongly opposed to stripping potentially valid data from all databases because of a limitation of one. I'd be in favor of loaddata checking for null bytes and complaining when the backend doesn't support that feature.
Regards, Michael Manfre On Mon, May 15, 2017 at 11:54 AM Tim Graham <[email protected]> wrote: > Does anyone know of a use case for using null bytes in CharField/TextField? > > psycopg2 2.7+ raises ValueError("A string literal cannot contain NUL > (0x00) characters.") when trying to save null bytes [0] and this > exception is unhandled in Django which allow malicious form submissions to > crash [1]. With psycopg2 < 2.7, there is no exception and null bytes are > silently truncated by PostgreSQL. Other databases that I tested (SQLite, > MySQL, Oracle) allow saving null bytes. This creates possible > cross-database compatibility problems when moving data from those databases > to PostgreSQL, e.g.[2]. > > I propose to have CharField and TextField strip null bytes from the value > either a) only on PostgreSQL or b) on all databases. Please indicate your > preference or suggest another solution. > > [0] https://github.com/psycopg/psycopg2/issues/420 > [1] https://code.djangoproject.com/ticket/28201 - Saving a Char/TextField > with psycopg2 2.7+ raises ValueError: A string literal cannot contain NUL > (0x00) characters is unhandled > [2] https://code.djangoproject.com/ticket/28117 - loaddata raises > ValueError with psycopg2 backend when data contains null bytes > > -- > You received this message because you are subscribed to the Google Groups > "Django developers (Contributions to Django itself)" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To post to this group, send email to [email protected]. > Visit this group at https://groups.google.com/group/django-developers. > To view this discussion on the web visit > https://groups.google.com/d/msgid/django-developers/9897126d-b6ef-48f1-9f19-96ed98ce10e5%40googlegroups.com > <https://groups.google.com/d/msgid/django-developers/9897126d-b6ef-48f1-9f19-96ed98ce10e5%40googlegroups.com?utm_medium=email&utm_source=footer> > . > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at https://groups.google.com/group/django-developers. To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/CAGdCwBsvwtr4F3j1jGo9uGTwBsjvU0ypLc%2B2q0482Peha3ejzw%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
