Hi, On 2025-02-15 13:33:54 +0100, Christoph Berg wrote: > Re: Andres Freund > > > > The fprintf suggests that since 5dc1e42b4 PQescapeIdentifier ignores > > > > its len. > > > > > > Ugh, yes. Need something like the attached. > > > > I just pushed this fix, together with an expansion of test_escape.c. With > > the > > expanded test both uses of strlen() are detected. > > FTR, this is also caught by pygresql's regression tests: > > test_inserttable_with_dotted_table_name > (tests.test_classic_connection.TestInserttable.test_inserttable_with_dotted_table_name) > ... ERROR > > https://ci.debian.net/packages/p/pygresql/testing/amd64/57838998/ > https://qa.debian.org/excuses.php?package=postgresql-17 > > What's missing in the PG regression tests to see that problem?
Well, the expanded tests added as part of the fix would catch it, but I agree, it's a problem this wasn't caught beforehand. I don't think that common uses of PQescapeIdentifier/Literal are likely to catch the problem, so it's perhaps not too surprising it wasn't caught. Which, I guess, shows that we really need more explicit edge-case coverage of at least the most crucial APIs (we barely have any). There's pretty much no way that pg_regress or TAP test style tests are going to catch a problem like this. Greetings, Andres Freund
