Lossily coerce invalid UTF-8 in sqlite collation callback (#4219)
The safe Fn(&str, &str) -> Ordering signature exposed by SqliteConnectOptions::collation() and LockedSqliteHandle::create_collation() was backed by from_utf8_unchecked, so a database containing invalid UTF-8 text could reach the user callback and materialize &str values that violate Rust's UTF-8 invariant inside a safe API. SQLite explicitly documents that invalid UTF-8 may be passed into application-defined collating sequences, so the FFI shim must not assume well-formed bytes. Replace from_utf8_unchecked with String::from_utf8_lossy, which matches the sqlite3_create_collation_v2 SQLITE_UTF8 flag and keeps the safe signature sound without changing correct-UTF-8 behavior. Fixes #4194 Co-authored-by: Joaquin Hui Gomez <joaquinhuigomez@users.noreply.github.com>
J
Joaquin Hui committed
e72f8224f87ae8a4540c3244b8a17e615d15b65b
Parent: 69ee0df
Committed by GitHub <noreply@github.com>
on 4/7/2026, 10:15:22 PM