ldbc: Text-protocol string escape misses NUL, newline and other characters
Fixed · medium · Security vulnerability
The text-protocol escape handles only quotes and backslashes, in the wrong order, so NUL, CR, LF and Ctrl-Z stay raw. If an attacker controls a string on that path, it can break out of the literal.
Found: ; reported: ; status since: . Reporter: Mike Murunov
Page for this report · Public report · Fix or proposed fix (see status)