Re: Validators accepting null bytes (\x00)

Brian Beck wrote:
> (Do people still post here?)
> 
> Not sure if this has been discussed before, but I'm concerned about some of
> the string validators accepting null bytes (the character \x00).
> 
> There's a nasty bug in Konqueror (I think it's a bug anyway) that adds null
> bytes onto some field values after editing them. Since my only validation
> was checking to make sure the .strip()ed strings were non-empty, null bytes
> were accepted (strip() does not get 'em). As I found out, passing null
> bytes along to the database is really, really bad. All values for that
> column in any row were replaced with the null-byte-containing value. So all
> that data was lost...

Yikes, that's scary.

> Is there any good reason to accept null bytes from form input, ever? If this
> were a general validation framework, sure, but isn't this geared towards
> just web forms?

It does get used in other places, so it needs to be somewhat general. 
The safest thing would be to get rid of \0's early on in the web 
request... though that's not always safe, and it's somewhat 
context-sensitive about when it is safe.  An image upload, for instance, 
can (should) have \0's in it.

> right now NotEmpty.from_python('\x00') and String.from_pyton('\x00') return
> '\x00'.

Maybe there should be a Text validator, that might include an optional 
unicode encoding, and would strip things like \0.  UTF-8 can't include 
\0, I think... but then, maybe the decoded value could include \0, and 
this could remove that.  Without encoding, it would be like String, but 
stripping \0.  String, like Python's str, is currently safe with binary 
data, and I don't think that should change.

-- 
Ian Bicking  /  [email protected]  /  http://blog.ianbicking.org


-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642