{"record":{"id":"18e7809e7ac2406a","repo":"Tencent/WeKnora","slug":"invalid-character-in-sql-query","errorCode":null,"errorMessage":"invalid character in SQL query","messagePattern":"invalid character in SQL query","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/inject.go","lineNumber":1328,"sourceCode":"\t}\n\n\treturn errors\n}\n\n// getMapKeys returns the keys of a map as a slice\nfunc getMapKeys(m map[string]bool) []string {\n\tkeys := make([]string, 0, len(m))\n\tfor k := range m {\n\t\tkeys = append(keys, k)\n\t}\n\treturn keys\n}\n\n// validateInput performs basic input validation\nfunc (v *sqlValidator) validateInput(sql string) error {\n\t// Check for null bytes\n\tif strings.Contains(sql, \"\\x00\") {\n\t\treturn fmt.Errorf(\"invalid character in SQL query\")\n\t}\n\n\t// Check length limits\n\tif len(sql) < v.minLength {\n\t\treturn fmt.Errorf(\"SQL query too short (min %d characters)\", v.minLength)\n\t}\n\tif len(sql) > v.maxLength {\n\t\treturn fmt.Errorf(\"SQL query too long (max %d characters)\", v.maxLength)\n\t}\n\n\treturn nil\n}\n\n// validateSelectStmt validates a SELECT statement with configured options\nfunc (v *sqlValidator) validateSelectStmt(stmt *pg_query.SelectStmt, result *SQLValidationResult) error {\n\ttablesInQuery := make(map[string]string) // table name -> alias\n\n\t// Check for UNION/INTERSECT/EXCEPT (compound queries)","sourceCodeStart":1310,"sourceCodeEnd":1346,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/inject.go#L1310-L1346","documentation":"sqlValidator.validateInput rejects any SQL containing a null byte (\\x00) with this error. Null bytes are never legitimate in SQL text and are a classic injection/obfuscation technique, so the validator fails fast. This feeds into SQLValidationError entries surfaced by ValidateSQL/ValidateAndSecureSQL.","triggerScenarios":"Passing SQL that contains an embedded \\x00 — typically from unsafe byte-to-string conversion of binary buffers, truncated C strings, or attacker-supplied input.","commonSituations":"Reading SQL from binary files or network buffers without sanitization; Go string([]byte) conversions of padded buffers; malicious payloads attempting parser confusion.","solutions":["Sanitize the input: reject strings containing \"\\x00\" before calling the validator","Fix the code that builds the SQL to not carry NUL padding","Treat this as a potential attack and log/reject the request source"],"exampleFix":"// before\nsecured, _, err := utils.ValidateAndSecureSQL(string(rawBuf))\n// after\nif strings.Contains(string(rawBuf), \"\\x00\") {\n    return fmt.Errorf(\"rejected SQL containing null byte\")\n}\nsecured, _, err := utils.ValidateAndSecureSQL(string(rawBuf))","handlingStrategy":"validation","validationCode":"func containsNullByte(s string) bool {\n    return strings.ContainsRune(s, '\\x00')\n}\nif containsNullByte(sql) {\n    return fmt.Errorf(\"rejecting query with null byte\")\n}","typeGuard":null,"tryCatchPattern":"if _, _, err := utils.ValidateAndSecureSQL(sql); err != nil &&\n    strings.Contains(err.Error(), \"invalid character in SQL query\") {\n    log.Warn(\"null byte in SQL — possible injection attempt\", \"len\", len(sql))\n    return err\n}","preventionTips":["Sanitize all SQL built from raw bytes (strip null bytes before string conversion)","Log and alert on null-byte inputs — treat them as attack signals","Verify utf8.Valid on byte input before converting to string","Never build SQL by concatenating binary or user input"],"tags":["sql","security","input-validation"],"backgroundTag":"invalid-character-in-sql","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}