go-sql-driver / mysql / 42625839620

87%

push

github

Harden interpolateParams against unsafe charsets and -- comments (#1836)

Reject interpolateParams=true when an unsafe multibyte charset (big5,
sjis, gbk, cp932, gb18030) is given by the charset DSN parameter or
Charset() option. Previously only the collation parameter was checked,
so charset=sjis&interpolateParams=true was silently accepted although
the README says such encodings are rejected. Every fallback charset is
checked, and collations are now matched case-insensitively and by their
charset prefix so that e.g. MariaDB's sjis_japanese_nopad_ci is caught.

Treat "--" followed by \v, \f, any other C0 control character or DEL as
the start of a comment, matching my_isspace() || my_iscntrl() in the
server's lexer. Before, a quote inside such a comment was taken as the
start of a string literal, so a later '?' inside a real string literal
could be replaced and the value would end up outside the literal.

Add a README note that interpolateParams does not fully replicate the
server's parser and that Prepare() should be used for arbitrary SQL.

30 of 30 new or added lines in 4 files covered. (100.0%)

3962 of 4597 relevant lines covered (86.19%)

1227100.03 hits per line