Repository navigation
TagResource and UntagResource: U+0000 in a tag key or value answers 500 on PostgreSQL #903
Description
What ExtendDB does
handle_tag_resource and handle_untag_resource in crates/engine/src/tagging.rs pass tag keys and values to storage without a character check. On PostgreSQL a key or value that carries U+0000 cannot be bound as a TEXT parameter, and the request answers 500 Internal server error. On SQLite the same TagResource and UntagResource requests answer 200.
Measured at ccdae81 of #830 on 2026-11-06 and at 9234b54 on 2026-11-07, on a table of the caller's account:
| Request | PostgreSQL | SQLite |
|---|---|---|
TagResource, Tags: [{"Key": "k<U+0000>", "Value": "v"}] |
500 Internal server error |
200 |
TagResource, Tags: [{"Key": "k", "Value": "v<U+0000>"}] |
500 Internal server error |
200 |
UntagResource, TagKeys: ["k<U+0000>"] |
500 Internal server error |
200 |
What DynamoDB does
Measured in us-east-1 on 2026-11-06, with SDK parameter validation off:
| Request | DynamoDB |
|---|---|
TagResource, key k<U+0000> |
ValidationException: The Tag Key provided is invalid, Key: k<U+0000> |
TagResource, value v<U+0000> |
ValidationException: The Tag Value provided is invalid, Value: v<U+0000> |
UntagResource, key k<U+0000> |
ValidationException: The Tag Key provided is invalid, Key: k<U+0000> |
The service renders U+0000 as the raw character in the message.
Suggested fix
Check tag keys in TagResource and UntagResource, and tag values in TagResource, before storage, with the sentences above. #444 covers the character and length rules of TagResource keys and values. It does not cover UntagResource TagKeys or the 500 on PostgreSQL, so the fix for #444 needs the UntagResource check too.
Activity