Files
bun.sh/test/regression/issue
robobun 44541eb574 fix(sql): reject null bytes in connection parameters to prevent protocol injection (#26952)
## Summary

- Reject null bytes in `username`, `password`, `database`, and `path`
connection parameters for both PostgreSQL and MySQL to prevent wire
protocol parameter injection
- Both the Postgres and MySQL wire protocols use null-terminated strings
in their startup/handshake messages, so embedded null bytes in these
fields act as field terminators, allowing injection of arbitrary
protocol parameters (e.g. `search_path` for schema hijacking)
- The fix validates these fields immediately after UTF-8 conversion and
throws `InvalidArguments` error with a clear message if null bytes are
found

## Test plan

- [x] New test
`test/regression/issue/postgres-null-byte-injection.test.ts` verifies:
- Null bytes in username are rejected with an error before any data is
sent
- Null bytes in database are rejected with an error before any data is
sent
- Null bytes in password are rejected with an error before any data is
sent
  - Normal connections without null bytes still work correctly
- [x] Test verified to fail with `USE_SYSTEM_BUN=1` (unfixed bun) and
pass with `bun bd test` (fixed build)
- [x] Existing SQL tests pass (`adapter-env-var-precedence.test.ts`,
`postgres-stringbuilder-assertion-aggressive.test.ts`)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Bot <claude-bot@bun.sh>
Co-authored-by: Claude <noreply@anthropic.com>
2026-02-12 00:27:00 -08:00
..
2025-08-06 06:44:46 -07:00
2025-01-28 17:23:57 -08:00
2025-06-03 13:23:12 -07:00
2025-06-03 23:41:37 -07:00
2025-01-17 22:08:07 -08:00
2024-06-14 01:50:36 -07:00
2025-03-03 21:38:05 -08:00
2025-05-26 21:18:22 -07:00
2025-07-03 01:06:22 -07:00
2025-07-23 22:31:42 -07:00
2025-10-20 14:07:31 -07:00
2025-11-05 22:04:14 -08:00
2025-11-05 22:04:14 -08:00
2025-11-19 21:17:51 -08:00
2026-01-13 22:38:31 -08:00
2025-07-20 23:02:10 -07:00