Summary
The MySQL LIKE escaper in consent-server/internal/consentelement/store.go does not escape literal backslashes in user input. If a consent element name contains a backslash character, it will be misinterpreted as an escape sequence in the SQL LIKE pattern, potentially causing unexpected query behavior.
Details
In consent-server/internal/consentelement/store.go, the MySQL escaper is built as:
escaper = strings.NewReplacer("%", "\\%", "_", "\\_")It is missing the backslash-to-double-backslash replacement. The correct version (matching the pattern already used in consent-server/internal/consentpurpose/store.go) should be:
escaper = strings.NewReplacer("\\", "\\\\", "%", "\\%", "_", "\\_")Impact
Consent element names containing a literal \ character will not be properly escaped before being used in a SQL LIKE query against MySQL.
Related
Note
This issue pre-existed before PR #23 (present since commit 8b93ecab) and was not introduced by that PR.
Summary
The MySQL
LIKEescaper inconsent-server/internal/consentelement/store.godoes not escape literal backslashes in user input. If a consent element name contains a backslash character, it will be misinterpreted as an escape sequence in the SQLLIKEpattern, potentially causing unexpected query behavior.Details
In
consent-server/internal/consentelement/store.go, the MySQL escaper is built as:It is missing the backslash-to-double-backslash replacement. The correct version (matching the pattern already used in
consent-server/internal/consentpurpose/store.go) should be:Impact
Consent element names containing a literal
\character will not be properly escaped before being used in a SQLLIKEquery against MySQL.Related
Note
This issue pre-existed before PR #23 (present since commit 8b93ecab) and was not introduced by that PR.