@ultimat3/schema 22.8.2 → 22.9.1

package/README.md

@@ -46,6 +46,13 @@ namespace member (`t.nullable`) and a free function (`nullableSchema`) — symme
 
 Unknown object keys are **dropped**, never forwarded — an action cannot be mass-assigned.
 
+Every string-backed schema (`string` `uuid` `email` `url` `timezone` `locale` `slug` `cursor`, with
+any `.min/.max/.pattern`) and every `t.record` key **refuses U+0000** — the one character Postgres
+`text` and `jsonb` cannot store, so a NUL that passed reached the row write as a 500. Tabs, newlines
+and the other C0 controls stay legal text. The issue names the fact, never the value:
+`title: expected a non-empty string, received a string of 3 characters that contains a NUL
+character (U+0000)`. Not published in the JSON Schema — it is a storage fact, not a format.
+
 ### Cross-field rules live on the schema
 
 A rule the IR cannot state structurally still belongs to the schema, or it moves into a handler and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/schema",
-  "version": "22.8.2",
+  "version": "22.9.1",
   "description": "Ultimate's validation seam: Standard Schema interface, the t namespace, JSON Schema output",
   "license": "MIT",
   "type": "module",

package/src/validators.ts

@@ -30,6 +30,10 @@ import { isIanaZoneName } from './time-zone-name';
 const EMAIL_RE = /^[^\s@]+@[^\s@.]+(\.[^\s@.]+)+$/;
 const SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 const CURSOR_RE = /^[A-Za-z0-9_-]+$/;
+/** The one code point no Postgres `text` or `jsonb` value can hold — see `stringLike`. */
+const NUL = '\u0000';
+/** Names the fact, never the content: the issue-message rule in `describe-value.ts`. */
+const NUL_REFUSAL = 'that contains a NUL character (U+0000)';
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 
 export interface StringSchema extends Schema<string, string> {
@@ -84,6 +88,11 @@ function stringLike(node: SchemaNode, what: string, test?: (value: string) => bo
   const matchesPattern = patternTester(node);
   const check: Check<string> = (value, path) => {
     if (typeof value !== 'string') return fail(path, expected(what, value));
+    // U+0000 is the one character Postgres cannot store: `text` and `jsonb` both refuse it
+    // (SQLSTATE 22021 / 22P05), so a NUL that passed here reached the row write — or a `where`
+    // bind — as `X_DB_STATEMENT_FAILED`, a 500 blaming the server for a byte the caller sent.
+    // Only NUL: a tab, a newline or any other C0 control is legal text Postgres stores unchanged.
+    if (value.includes(NUL)) return fail(path, `${expected(what, value)} ${NUL_REFUSAL}`);
     if (node.minLength !== undefined && charCount(value) < node.minLength) {
       return fail(path, expected(`${what} of at least ${node.minLength} chars`, value));
     }
@@ -303,6 +312,12 @@ export function recordSchema<S extends AnySchema>(
         // new spelling to learn. It is `Object.entries` order — integer-like keys sort ahead of
         // string ones — so it names an entry that exists rather than a byte offset in the body.
         const at = [...path, index];
+        // A record is stored as `jsonb` far more often than not, and jsonb refuses a NUL in a KEY
+        // exactly as it does in a value — so the key is refused here, by position, not quoted.
+        if (key.includes(NUL)) {
+          issues.push({ message: `expected a record key, received one ${NUL_REFUSAL}`, path: at });
+          continue;
+        }
         if (isPrototypeKey(key)) {
           issues.push({
             // The refused NAMES are a closed set declared right here, so the message may state