Skip to content

Write jsonb strings needing an escape as TEXTJ - #5203

Draft
LucaCappelletti94 wants to merge 1 commit into
diesel-rs:mainfrom
LucaCappelletti94:fuzz-sqlite-jsonb-text-writer
Draft

Write jsonb strings needing an escape as TEXTJ#5203
LucaCappelletti94 wants to merge 1 commit into
diesel-rs:mainfrom
LucaCappelletti94:fuzz-sqlite-jsonb-text-writer

Conversation

@LucaCappelletti94

@LucaCappelletti94 LucaCappelletti94 commented Sep 4, 2026

Copy link
Copy Markdown
Member

write_jsonb_string reached for TEXTJ only when a string held a control character, so a string containing a quote or a backslash went out as TEXT with the character raw in the payload. a"b became 37 61 22 62, which sqlite reports as invalid through json_valid(blob, 8) and refuses in json(), because TEXT is defined as a payload that renders as JSON unchanged. Diesel reads its own blob back fine, so what breaks is every sqlite JSON function applied to a column diesel wrote.

Any string carrying a byte JSON has to escape, meaning anything below 0x20 plus the quote and the backslash, now goes down the TEXTJ path that already existed for control characters. TEXTRAW would also be well formed, but TEXTJ is byte for byte what sqlite's own jsonb('"a\"b"') writes, so a blob diesel wrote stays comparable with one sqlite wrote for the same value. The scan moved from char::is_control to bytes at the same time, since JSON escapes nothing above 0x1F while is_control also covers U+007F to U+009F, which sqlite stores as plain TEXT.

This came out of a fuzzer I am writing for diesel's deserialization code.

@LucaCappelletti94 LucaCappelletti94 changed the title Write escaped jsonb strings as TEXTRAW Write jsonb strings needing an escape as TEXTJ Sep 5, 2026
@LucaCappelletti94
LucaCappelletti94 force-pushed the fuzz-sqlite-jsonb-text-writer branch from a2e58c1 to b80d046 Compare September 5, 2026 05:35
@weiznich
weiznich requested a review from a team September 5, 2026 09:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant