Gitea returns a 500 when searching for %00

[Bwko]

• Gitea version (or commit ref): 27d6685
• Git version: 2.10.2
• Operating system: Arch linux
• Database:
  • PostgreSQL 9.6.1 en_US.utf8
  • MySQL
  • SQLite
• Log gist: 2016/11/28 23:43:28 [...itea/routers/home.go:93 RenderRepoSearch()] [E] SearchRepositoryByName: Count: pq: invalid byte sequence for encoding "UTF8": 0x00

Go to your local Gitea server, enter %00 behind ?q= (like http://localhost/explore/repos?q=%00) and Gitea returns a 500 error

[lunny]

The error returned by postgres. For Golang,

utf8.ValidString(url.QueryUnescape("%00"))

will return true. but postgres don't think so.

[tboerger]

Should we add a list of strings that get stripped before sending to the db?

[lunny]

Yes, I think maybe we have to write a regex? to limit the keyword.

[thibaultmeyer]

a regexp to avoid all non-printable chars could be useful. Of maybe is the job of the ORM to sanitize data before send it to SQL server ?

[lunny]

Sounds reasonable. Maybe it's the database/sql drivers' work :)

[bkcsoft]

It's a limitation in PostgreSQL
http://stackoverflow.com/questions/28813409/are-null-bytes-allowed-in-unicode-strings-in-postgresql-via-python
https://www.postgresql.org/message-id/4A271678.6010405@postnewspapers.com.au

[Bwko]

@lunny could you fix this?

[lunny]

Just ignoring %00 could fix this bug. But if there are other characters will result in 500?

[Bwko]

To my knowledge %00 are the only characters that result in a 500