You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The way the jdbc driver handles un-escaped NUL bytes in a SQL statement means they are ostensibly converted to a C-style string and truncated at the NUL.
While it can be argued this is malformed input and user error, and fine as it is, the error messages are needlessly confusing, and it's possibly an unnecessary attack surface for SQL injections.
If it's true that un-escaped NUL bytes in queries are never valid, it may be preferable to validate the query in DuckDBPreparedStatement, which ought to be a very cheap operation.
java.sql.SQLException: Parser Error: unterminated quoted string at or near "'a"
LINE 1: SELECT 'a
^
java.sql.SQLException: java.sql.SQLException: Parser Error: unterminated quoted string at or near "'a"
LINE 1: SELECT 'a
The text was updated successfully, but these errors were encountered:
The way the jdbc driver handles un-escaped NUL bytes in a SQL statement means they are ostensibly converted to a C-style string and truncated at the NUL.
While it can be argued this is malformed input and user error, and fine as it is, the error messages are needlessly confusing, and it's possibly an unnecessary attack surface for SQL injections.
If it's true that un-escaped NUL bytes in queries are never valid, it may be preferable to validate the query in
DuckDBPreparedStatement
, which ought to be a very cheap operation.Steps to reproduce:
The text was updated successfully, but these errors were encountered: