go-sql-driver / mysql / 40470381080

86%

master: 86%

Build Type

Pull #1836

github

Committed by methane

Commit Message

Harden interpolateParams against unsafe charsets and -- comments

Reject interpolateParams=true when an unsafe multibyte charset (big5,
sjis, gbk, cp932, gb18030) is given by the charset DSN parameter or
Charset() option. Previously only the collation parameter was checked,
so charset=sjis&interpolateParams=true was silently accepted although
the README says such encodings are rejected. Every fallback charset is
checked, and collations are now matched case-insensitively and by their
charset prefix so that e.g. MariaDB's sjis_japanese_nopad_ci is caught.

Treat "--" followed by \v, \f, any other C0 control character or DEL as
the start of a comment, matching my_isspace() || my_iscntrl() in the
server's lexer. Before, a quote inside such a comment was taken as the
start of a string literal, so a later '?' inside a real string literal
could be replaced and the value would end up outside the literal.

Add a README note that interpolateParams does not fully replicate the
server's parser and that Prepare() should be used for arbitrary SQL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Pull Request Pull Request #1836: Harden interpolateParams against unsafe charsets and -- comments

Coverage Stats

24 of 24 new or added lines in 3 files covered. (100.0%)

75 existing lines in 2 files now uncovered.

3941 of 4580 relevant lines covered (86.05%)

1231622.67 hits per line