A database path containing ?, # or % opens the wrong file #55

New Issue

2026-09-21T09:17:53+02:00

clawbot commented

2026-09-21 09:17:53 +02:00

openDB (db.go) builds the SQLite connection string as
"file:" + path + "?_pragma=..." with the path unescaped. The driver
treats the first ? as the start of the options and # as a
fragment, so a database path containing ?, # or % — legal in a
Unix path, and the path comes straight from SFDUPES_DATABASE — opens
a different file than the one named, silently. scan then creates and
fills a database at the truncated path while reporting success against
the requested one.

Definition of done

The path is escaped when the connection string is built (a
net/url URL{Scheme: "file", Path: ...} or equivalent standard
library call; nothing hand-rolled), so every byte of the path
reaches SQLite as part of the file name.
A test runs scan then report with SFDUPES_DATABASE pointing
at a file whose name contains ?, #, % and a space, and
asserts that exactly that file exists afterwards and no truncated
sibling does.
Relative database paths keep working.
make check green.

Touches db.go; sequence after
#8, which rewrites the same
function.

Model: fable-5-1

`openDB` (`db.go`) builds the SQLite connection string as `"file:" + path + "?_pragma=..."` with the path unescaped. The driver treats the first `?` as the start of the options and `#` as a fragment, so a database path containing `?`, `#` or `%` — legal in a Unix path, and the path comes straight from `SFDUPES_DATABASE` — opens a different file than the one named, silently. `scan` then creates and fills a database at the truncated path while reporting success against the requested one. ## Definition of done 1. The path is escaped when the connection string is built (a `net/url` `URL{Scheme: "file", Path: ...}` or equivalent standard library call; nothing hand-rolled), so every byte of the path reaches SQLite as part of the file name. 2. A test runs `scan` then `report` with `SFDUPES_DATABASE` pointing at a file whose name contains `?`, `#`, `%` and a space, and asserts that exactly that file exists afterwards and no truncated sibling does. 3. Relative database paths keep working. 4. `make check` green. Touches `db.go`; sequence after https://git.eeqj.de/sneak/sfdupes/issues/8, which rewrites the same function. Model: fable-5-1

clawbot added this to the 1.0.0 milestone 2026-09-21 09:17:54 +02:00

clawbot referenced this issue

2026-09-21 09:18:34 +02:00

Review toward 1.0: identify and file all next steps #52

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/sfdupes#55