What causes "invalid character in SQL query" in Tencent/WeKnora?

Sanitize the input: reject strings containing "\x00" before calling the validator

invalid character in SQL query

Error message

invalid character in SQL query

What it means

sqlValidator.validateInput rejects any SQL containing a null byte (\x00) with this error. Null bytes are never legitimate in SQL text and are a classic injection/obfuscation technique, so the validator fails fast. This feeds into SQLValidationError entries surfaced by ValidateSQL/ValidateAndSecureSQL.

Source

Thrown at internal/utils/inject.go:1328

	}

	return errors
}

// getMapKeys returns the keys of a map as a slice
func getMapKeys(m map[string]bool) []string {
	keys := make([]string, 0, len(m))
	for k := range m {
		keys = append(keys, k)
	}
	return keys
}

// validateInput performs basic input validation
func (v *sqlValidator) validateInput(sql string) error {
	// Check for null bytes
	if strings.Contains(sql, "\x00") {
		return fmt.Errorf("invalid character in SQL query")
	}

	// Check length limits
	if len(sql) < v.minLength {
		return fmt.Errorf("SQL query too short (min %d characters)", v.minLength)
	}
	if len(sql) > v.maxLength {
		return fmt.Errorf("SQL query too long (max %d characters)", v.maxLength)
	}

	return nil
}

// validateSelectStmt validates a SELECT statement with configured options
func (v *sqlValidator) validateSelectStmt(stmt *pg_query.SelectStmt, result *SQLValidationResult) error {
	tablesInQuery := make(map[string]string) // table name -> alias

	// Check for UNION/INTERSECT/EXCEPT (compound queries)

View on GitHub (pinned to 988cbb0330)

Solutions

Sanitize the input: reject strings containing "\x00" before calling the validator
Fix the code that builds the SQL to not carry NUL padding
Treat this as a potential attack and log/reject the request source

Example fix

// before
secured, _, err := utils.ValidateAndSecureSQL(string(rawBuf))
// after
if strings.Contains(string(rawBuf), "\x00") {
    return fmt.Errorf("rejected SQL containing null byte")
}
secured, _, err := utils.ValidateAndSecureSQL(string(rawBuf))

Defensive patterns

Strategy: validation

Validate before calling

func containsNullByte(s string) bool {
    return strings.ContainsRune(s, '\x00')
}
if containsNullByte(sql) {
    return fmt.Errorf("rejecting query with null byte")
}

Try / catch

if _, _, err := utils.ValidateAndSecureSQL(sql); err != nil &&
    strings.Contains(err.Error(), "invalid character in SQL query") {
    log.Warn("null byte in SQL — possible injection attempt", "len", len(sql))
    return err
}

Prevention

Sanitize all SQL built from raw bytes (strip null bytes before string conversion)
Log and alert on null-byte inputs — treat them as attack signals
Verify utf8.Valid on byte input before converting to string
Never build SQL by concatenating binary or user input

When it happens

Trigger: Passing SQL that contains an embedded \x00 — typically from unsafe byte-to-string conversion of binary buffers, truncated C strings, or attacker-supplied input.

Common situations: Reading SQL from binary files or network buffers without sanitization; Go string([]byte) conversions of padded buffers; malicious payloads attempting parser confusion.

Understand the failure class

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/18e7809e7ac2406a. Report an issue: GitHub.