More safety checks around comments (#722)

elixir-ecto · Dec 19, 2024 · c3097f4 · c3097f4
1 parent 6d9e2ca
commit c3097f4
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/lib/postgrex.ex b/lib/postgrex.ex
@@ -68,7 +68,8 @@ defmodule Postgrex do
   @timeout 15_000
 
   @comment_validation_error Postgrex.Error.exception(
-                              message: "`:comment` option cannot contain sequence \"*/\""
+                              message:
+                                "`:comment` option cannot contain null bytes and \"*/\" sequence"
                             )
 
   ### PUBLIC API ###
@@ -336,7 +337,7 @@ defmodule Postgrex do
         true
 
       comment when is_binary(comment) ->
-        if String.contains?(comment, "*/") do
+        if String.contains?(comment, [<<0>>, "*/"]) do
           raise @comment_validation_error
         else
           false

diff --git a/test/query_test.exs b/test/query_test.exs
@@ -1857,6 +1857,10 @@ defmodule QueryTest do
     assert_raise Postgrex.Error, fn ->
       query("select 123", [], comment: "*/ DROP TABLE 123 --")
     end
+
+    assert_raise Postgrex.Error, fn ->
+      query("select 123", [], comment: <<0>> <> "comment")
+    end
   end
 
   @tag :big_binary