Merge branch 'nul-terminator'

NEWS

@@ -24,6 +24,8 @@ New features:
 What's new in psycopg 2.6.3
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
+- Throw an exception trying to pass ``NULL`` chars as parameters
+  (:ticket:`#420).
 - Make `~psycopg2.extras.Range` objects picklable (:ticket:`#462`).
 
 

psycopg/utils.c

@@ -50,8 +50,13 @@ psycopg_escape_string(connectionObject *conn, const char *from, Py_ssize_t len,
     Py_ssize_t ql;
     int eq = (conn && (conn->equote)) ? 1 : 0;
 
-    if (len == 0)
+    if (len == 0) {
         len = strlen(from);
+    } else if (strchr(from, '\0') != from + len) {
+        PyErr_Format(PyExc_ValueError, "A string literal cannot contain NUL (0x00) characters.");
+
+	return NULL;
+    }
 
     if (to == NULL) {
         to = (char *)PyMem_Malloc((len * 2 + 4) * sizeof(char));

tests/test_quote.py

@@ -62,6 +62,15 @@ class QuotingTestCase(ConnectingTestCase):
         self.assertEqual(res, data)
         self.assert_(not self.conn.notices)
 
+    def test_string_null_terminator(self):
+        curs = self.conn.cursor()
+        data = 'abcd\x01\x00cdefg'
+
+        with self.assertRaises(ValueError) as e:
+            curs.execute("SELECT %s", (data,))
+
+        self.assertEquals(e.exception.message, 'A string literal cannot contain NUL (0x00) characters.')
+
     def test_binary(self):
         data = b("""some data with \000\013 binary
         stuff into, 'quotes' and \\ a backslash too.