You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As discovered via #1477, some strings may have special meaning to the server, which is usually a very bad idea as it mixes user data with implementation logic in unexpected ways. A string such as _nil_ for example might very easily be part of the data imported into the system, and it would magically disappear once stored.
As a recommendation, I would make SetValueString in the Go code respect the input value exactly. Even escaping should be applied internally, instead of expecting developers to escape the value by themselves. If the low-level functionality is necessary for certain tools, I would make that explicit in the API name, such as SetValueRaw or similar, and make the rules there more clear so people can tell what to expect when using it.
The text was updated successfully, but these errors were encountered:
I've made some changed in a branch fix_nil_string that I created while working on #1627 . They might be useful when we work on this. It will probably be easier to work on this issue once the client/transaction work has been finished -- since handling empty strings will be easier when we no longer delete an edge by not setting the object (i.e leave it as an empty string).
As discovered via #1477, some strings may have special meaning to the server, which is usually a very bad idea as it mixes user data with implementation logic in unexpected ways. A string such as
_nil_
for example might very easily be part of the data imported into the system, and it would magically disappear once stored.As a recommendation, I would make
SetValueString
in the Go code respect the input value exactly. Even escaping should be applied internally, instead of expecting developers to escape the value by themselves. If the low-level functionality is necessary for certain tools, I would make that explicit in the API name, such as SetValueRaw or similar, and make the rules there more clear so people can tell what to expect when using it.The text was updated successfully, but these errors were encountered: