SIGN IN SIGN UP

Lossily coerce invalid UTF-8 in sqlite collation callback (#4219)

The safe Fn(&str, &str) -> Ordering signature exposed by
SqliteConnectOptions::collation() and LockedSqliteHandle::create_collation()
was backed by from_utf8_unchecked, so a database containing invalid UTF-8
text could reach the user callback and materialize &str values that violate
Rust's UTF-8 invariant inside a safe API.

SQLite explicitly documents that invalid UTF-8 may be passed into
application-defined collating sequences, so the FFI shim must not assume
well-formed bytes. Replace from_utf8_unchecked with String::from_utf8_lossy,
which matches the sqlite3_create_collation_v2 SQLITE_UTF8 flag and keeps
the safe signature sound without changing correct-UTF-8 behavior.

Fixes #4194

Co-authored-by: Joaquin Hui Gomez <joaquinhuigomez@users.noreply.github.com>
J
Joaquin Hui committed
e72f8224f87ae8a4540c3244b8a17e615d15b65b
Parent: 69ee0df
Committed by GitHub <noreply@github.com> on 4/7/2026, 10:15:22 PM