pg_net causes database to crash if url is null

[Philipp Steinrötter]

Bug report

Describe the bug

If the url is null, the database crashes

To Reproduce

supabase init
supabase start
docker restart <your-db-container-name> (see supabase/cli#137)
Go to the sql editor and run the following code

create extension if not exists pg_net;

create table if not exists test (
  id uuid primary key default gen_random_uuid()
);

create or replace function test_trigger()
  returns trigger
  language plpgsql
  security invoker
as
$$
begin
  perform
    net.http_post(
        url:=null,
        body:='{"hello": "world"}'::jsonb
    );
  return new;
end
$$;

create trigger call_test_trigger
after insert on test
for each row execute procedure test_trigger();

insert into test default values;

Result: Connection terminated unexpectedly

Expected behavior

An exception is raised telling the user that the url cannot be null.

System information

• OS: macOS

[Steve Chavez]

Can reproduce, this crashes the connection

select net.http_post(null, '{"hello": "world"}'::jsonb);

server closed the connection unexpectedly
        This probably means the server terminated abnormally
        before or while processing the request.
The connection to the server was lost. Attempting reset: 2022-08-31 18:13:06.420 -05 [132919] LOG:  server process (PID 132933) was terminated by signal 11: Segmentation fault
2022-08-31 18:13:06.420 -05 [132919] DETAIL:  Failed process was running: select net.http_post(null, '{"hello": "world"}'::jsonb);
2022-08-31 18:13:06.420 -05 [132919] LOG:  terminating any other active server processes

[Steve Chavez]

Happens because on net.http_post

pg_net/sql/pg_net.sql

Lines 135 to 147 in deed712

     insert into net.http_request_queue(method, url, headers, timeout_milliseconds) 
     values ( 
         'GET', 
         net._encode_url_with_params_array(url, params_array), 
         headers, 
         timeout_milliseconds 
     ) 
     returning id 
     into request_id; 
  
     return request_id; 
 end 
 $$; 

The net._encode_url_with_params_array accepts nulls and it segfaults in the C code

pg_net/sql/pg_net.sql

Lines 98 to 104 in deed712

 create or replace function net._encode_url_with_params_array(url text, params_array text[]) 
     -- url encoded string 
     returns text 
  
     language 'c' 
     immutable 
 as 'pg_net'; 

While the url of the queue is not null

pg_net/sql/pg_net.sql

Lines 11 to 19 in deed712

 create table net.http_request_queue( 
     id bigserial primary key, 
     method net.http_method not null, 
     url text not null, 
     headers jsonb not null, 
     body bytea, 
     -- TODO: respect this 
     timeout_milliseconds int not null 
 ); 

The simple solution is making the _encode_url_with_params_array STRICT so it returns NULL and let the non-null constraint of the queue fail.