Skip to content

Reject invalid BIT column defaults - #487

Merged
JanJakes merged 2 commits into
trunkfrom
default-fix
Aug 12, 2026
Merged

Reject invalid BIT column defaults#487
JanJakes merged 2 commits into
trunkfrom
default-fix

Conversation

@JanJakes

@JanJakes JanJakes commented Aug 12, 2026

Copy link
Copy Markdown
Member

Summary

Reject invalid BIT column defaults instead of preserving unnormalized input in the emulated information schema. Unsupported values now return MySQL-compatible error 1067.

Why

The BIT default accepted any value beginning with a valid prefix and stored the original value. SHOW CREATE TABLE later emitted that value without quoting, allowing untrusted text to become executable SQL in a generated MySQL dump.

This is a hotfix that requires valid literal forms and rejects anything that cannot be safely normalized. Broader default validation based on the AST and full column definition should be done as a follow-up, also for other types.

This prevents untrusted SQL from being embedded in generated MySQL DDL during migration.

Require exact BIT and hexadecimal literal forms during normalization. Reject values that cannot be normalized with MySQL error 1067 so arbitrary strings cannot be stored and emitted as SQL.
@JanJakes
JanJakes requested a review from adamziel August 12, 2026 07:33
@JanJakes
JanJakes marked this pull request as ready for review August 12, 2026 11:55
Match MySQL by coercing an empty string default to zero and storing it as a canonical bit literal.
@JanJakes

Copy link
Copy Markdown
Member Author

Pushed the DEFAULT '' fix and going ahead and merging this for the release.

@JanJakes
JanJakes merged commit 123ebef into trunk Aug 12, 2026
24 checks passed
@JanJakes
JanJakes deleted the default-fix branch August 12, 2026 13:58
This was referenced Aug 12, 2026
JanJakes added a commit that referenced this pull request Aug 12, 2026
## Release `3.0.0-rc.9`

Version bump and changelog update for release `3.0.0-rc.9`.

**Changelog draft:**
* Reject invalid BIT column defaults
([#487](#487))
* Make Composer packages installable
([#486](#486))
* Remove INET_ATON WordPress dependency
([#485](#485))
* Restore database version support for older WordPress releases
([#484](#484))
* Finalize MySQL-on-SQLite 3.0 refinements
([#482](#482))
* Prefix SQLite-specific constructor options
([#481](#481))
* Unify emulated MySQL server identity
([#479](#479))
* Document the 3.0 driver API
([#477](#477))
* Expand PDO API coverage
([#471](#471))
* Refine the 3.0 API surface
([#469](#469))
* Add ANSI_QUOTES and SQL mode validation
([#452](#452))

**Full changelog:**
v3.0.0-rc.8...release/v3.0.0-rc.9

## Next steps

1. **Review** the changes in this pull request.
2. **Push** any additional edits to this branch (`release/v3.0.0-rc.9`).
3. **Merge** this pull request to complete the release.

Merging will automatically build the plugin ZIP and create a [GitHub
release](https://github.com/WordPress/sqlite-database-integration/releases).

> [!NOTE]
> This is a **pre-release**. It will not be deployed to
[WordPress.org](https://wordpress.org/plugins/sqlite-database-integration/).
@JanJakes JanJakes added this to the Release 3.0 milestone Aug 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant