Throw error on \0

benjie · benjie · commit 84d94210d19f · 2023-03-13T08:14:17.000Z
diff --git a/packages/pg/lib/client.js b/packages/pg/lib/client.js
@@ -444,7 +444,21 @@ class Client extends EventEmitter {
 
   // Ported from PostgreSQL 9.2.4 source code in src/interfaces/libpq/fe-exec.c
   escapeIdentifier(str) {
-    return '"' + str.replace(/["\0]/g, '""') + '"'
+    var escaped = '"'
+
+    for (var i = 0; i < str.length; i++) {
+      var c = str[i]
+      if (c === '"') {
+        escaped += c + c
+      } else if (c === '\0') {
+        throw new Error("Identifier contains \\0 which is not allowed in PostgreSQL identifiers.");
+      } else {
+        escaped += c
+      }
+    }
+
+    escaped += '"'
+    return escaped
   }
 
   // Ported from PostgreSQL 9.2.4 source code in src/interfaces/libpq/fe-exec.c
@@ -460,7 +474,7 @@ class Client extends EventEmitter {
         escaped += c + c
         hasBackslash = true
       } else if (c === '\0') {
-        // Ignore it
+        throw new Error("Literal contains \\0 which is not allowed in PostgreSQL strings.");
       } else {
         escaped += c
       }
