#30064: Admin search with a null character crashes with "A string literal cannot
contain NUL (0x00) characters." on PostgreSQL
-------------------------------+------------------------------------
Reporter: kenichi-cc | Owner: nobody
Type: Bug | Status: new
Component: contrib.admin | Version: 2.1
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 1
Easy pickings: 0 | UI/UX: 0
-------------------------------+------------------------------------
Comment (by Simon Charette):
> I thought that the parameter of a single execution doesn't affect too
much. when the validator is called, the same case about performance would
happen here as well.
I think it's safe to assume every non-static or cached request handled by
Django results in at least one database queries and that it isn't uncommon
for queries to have at least one string parameter. Given these assumptions
it's unlikely that performing a one time per admin changelist search
request validation is ever going to have the same performance implications
as performing a search and replace for every `'\x00'` string parameters
provided to the ORM.
> Wouldn't it be better if a solution that also solves the raw query
parameters? Users wouldn't have to check it out.
I don't think so. User input should be sanitized before feeding it to the
ORM.
--
Ticket URL: <https://code.djangoproject.com/ticket/30064#comment:6>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/068.124da056e7d61f5792851b422b0a3ae1%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
