MySQL LIKE escaping in consentelement store is missing backslash escape #24
Description
Summary
The MySQL LIKE escaper in consent-server/internal/consentelement/store.go does not escape literal backslashes in user input. If a consent element name contains a backslash character, it will be misinterpreted as an escape sequence in the SQL LIKE pattern, potentially causing unexpected query behavior.
Details
In consent-server/internal/consentelement/store.go, the MySQL escaper is built as:
escaper = strings.NewReplacer("%", "\\%", "_", "\\_")It is missing the backslash-to-double-backslash replacement. The correct version (matching the pattern already used in consent-server/internal/consentpurpose/store.go) should be:
escaper = strings.NewReplacer("\\", "\\\\", "%", "\\%", "_", "\\_")Impact
Consent element names containing a literal \ character will not be properly escaped before being used in a SQL LIKE query against MySQL.
Related
- PR: Add SQLite Support #23
- Review comment: Add SQLite Support #23 (comment)
- Reported by: @ThaminduDilshan
Note
This issue pre-existed before PR #23 (present since commit 8b93ecab) and was not introduced by that PR.