robobun 44541eb574 fix(sql): reject null bytes in connection parameters to prevent protocol injection (#26952) ...

## Summary

- Reject null bytes in `username`, `password`, `database`, and `path`
connection parameters for both PostgreSQL and MySQL to prevent wire
protocol parameter injection
- Both the Postgres and MySQL wire protocols use null-terminated strings
in their startup/handshake messages, so embedded null bytes in these
fields act as field terminators, allowing injection of arbitrary
protocol parameters (e.g. `search_path` for schema hijacking)
- The fix validates these fields immediately after UTF-8 conversion and
throws `InvalidArguments` error with a clear message if null bytes are
found

## Test plan

- [x] New test
`test/regression/issue/postgres-null-byte-injection.test.ts` verifies:
- Null bytes in username are rejected with an error before any data is
sent
- Null bytes in database are rejected with an error before any data is
sent
- Null bytes in password are rejected with an error before any data is
sent
  - Normal connections without null bytes still work correctly
- [x] Test verified to fail with `USE_SYSTEM_BUN=1` (unfixed bun) and
pass with `bun bd test` (fixed build)
- [x] Existing SQL tests pass (`adapter-env-var-precedence.test.ts`,
`postgres-stringbuilder-assertion-aggressive.test.ts`)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Bot <claude-bot@bun.sh>
Co-authored-by: Claude <noreply@anthropic.com>

2026-02-12 00:27:00 -08:00

..

fixtures

Fix request.url having incorrect port

2023-10-16 15:14:15 -07:00

issue

fix(sql): reject null bytes in connection parameters to prevent protocol injection (#26952)

2026-02-12 00:27:00 -08:00

brotli-reset-leak.test.ts

fix: memory leaks in error-handling code for Brotli, Zstd, and Zlib compression state machines (#25592)

2025-12-18 21:42:14 -08:00

issue23966.test.ts

Fix Buffer.isEncoding('') to return false (#23968)

2025-10-22 16:15:29 -07:00