github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-03-14 20:07:40 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

Gitea returns a 500 when searching for %00 #90

New Issue
Closed
opened 2025-11-02 03:08:19 -06:00 by GiteaMirror · 9 comments
GiteaMirror commented 2025-11-02 03:08:19 -06:00
Owner
Copy Link

Originally created by @Bwko on GitHub (Nov 28, 2016).

  • Gitea version (or commit ref): 27d66855eb
  • Git version: 2.10.2
  • Operating system: Arch linux
  • Database:
    • PostgreSQL 9.6.1 en_US.utf8
    • MySQL
    • SQLite
  • Log gist: 2016/11/28 23:43:28 [...itea/routers/home.go:93 RenderRepoSearch()] [E] SearchRepositoryByName: Count: pq: invalid byte sequence for encoding "UTF8": 0x00

Go to your local Gitea server, enter %00 behind ?q= (like http://localhost/explore/repos?q=%00) and Gitea returns a 500 error

Originally created by @Bwko on GitHub (Nov 28, 2016). - Gitea version (or commit ref): 27d66855eb642b22852b557cbb8ffd7781d73d4e - Git version: 2.10.2 - Operating system: Arch linux - Database: - [x] PostgreSQL 9.6.1 en_US.utf8 - [ ] MySQL - [ ] SQLite - Log gist: `2016/11/28 23:43:28 [...itea/routers/home.go:93 RenderRepoSearch()] [E] SearchRepositoryByName: Count: pq: invalid byte sequence for encoding "UTF8": 0x00` Go to your local Gitea server, enter %00 behind ?q= (like http://localhost/explore/repos?q=%00) and Gitea returns a 500 error
GiteaMirror added the type/bug label 2025-11-02 03:08:19 -06:00
GiteaMirror commented 2025-11-02 03:08:20 -06:00
Author
Owner
Copy Link

@lunny commented on GitHub (Nov 29, 2016):

The error returned by postgres. For Golang,

utf8.ValidString(url.QueryUnescape("%00"))

will return true. but postgres don't think so.

@lunny commented on GitHub (Nov 29, 2016): The error returned by postgres. For Golang, ``` utf8.ValidString(url.QueryUnescape("%00")) ``` will return true. but postgres don't think so.
GiteaMirror commented 2025-11-02 03:08:20 -06:00
Author
Owner
Copy Link

@tboerger commented on GitHub (Nov 29, 2016):

Should we add a list of strings that get stripped before sending to the db?

@tboerger commented on GitHub (Nov 29, 2016): Should we add a list of strings that get stripped before sending to the db?
GiteaMirror commented 2025-11-02 03:08:20 -06:00
Author
Owner
Copy Link

@lunny commented on GitHub (Nov 29, 2016):

Yes, I think maybe we have to write a regex? to limit the keyword.

@lunny commented on GitHub (Nov 29, 2016): Yes, I think maybe we have to write a regex? to limit the keyword.
GiteaMirror commented 2025-11-02 03:08:20 -06:00
Author
Owner
Copy Link

@thibaultmeyer commented on GitHub (Nov 29, 2016):

a regexp to avoid all non-printable chars could be useful. Of maybe is the job of the ORM to sanitize data before send it to SQL server ?

@thibaultmeyer commented on GitHub (Nov 29, 2016): a regexp to avoid all non-printable chars could be useful. Of maybe is the job of the ORM to sanitize data before send it to SQL server ?
GiteaMirror commented 2025-11-02 03:08:21 -06:00
Author
Owner
Copy Link

@lunny commented on GitHub (Nov 29, 2016):

Sounds reasonable. Maybe it's the database/sql drivers' work :)

@lunny commented on GitHub (Nov 29, 2016): Sounds reasonable. Maybe it's the `database/sql` drivers' work :)
GiteaMirror commented 2025-11-02 03:08:21 -06:00
Author
Owner
Copy Link

@bkcsoft commented on GitHub (Nov 29, 2016):

It's a limitation in PostgreSQL
http://stackoverflow.com/questions/28813409/are-null-bytes-allowed-in-unicode-strings-in-postgresql-via-python
https://www.postgresql.org/message-id/4A271678.6010405@postnewspapers.com.au

@bkcsoft commented on GitHub (Nov 29, 2016): It's a limitation in PostgreSQL http://stackoverflow.com/questions/28813409/are-null-bytes-allowed-in-unicode-strings-in-postgresql-via-python https://www.postgresql.org/message-id/4A271678.6010405@postnewspapers.com.au
GiteaMirror commented 2025-11-02 03:08:21 -06:00
Author
Owner
Copy Link

@Bwko commented on GitHub (Nov 29, 2016):

@lunny could you fix this?

@Bwko commented on GitHub (Nov 29, 2016): @lunny could you fix this?
GiteaMirror commented 2025-11-02 03:08:21 -06:00
Author
Owner
Copy Link

@lunny commented on GitHub (Nov 30, 2016):

Just ignoring %00 could fix this bug. But if there are other characters will result in 500?

@lunny commented on GitHub (Nov 30, 2016): Just ignoring `%00` could fix this bug. But if there are other characters will result in 500?
GiteaMirror commented 2025-11-02 03:08:21 -06:00
Author
Owner
Copy Link

@Bwko commented on GitHub (Nov 30, 2016):

To my knowledge %00 are the only characters that result in a 500

@Bwko commented on GitHub (Nov 30, 2016): To my knowledge `%00` are the only characters that result in a 500
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No Label type/bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#90
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?