What the developer wrote
Authored by yyforyongyu
sqldb/v2: harden fixture names
Sanitize Docker container names more aggressively and add a
random suffix so concurrent test runs do not collide on the
same fixture name.
Normalize unsupported characters, trim leading and trailing
punctuation, and keep the fallback name for cases that sanitize
down to nothing. Add unit coverage for the sanitizer so the
allowed name surface stays explicit.
What changed, and why it matters
This change tightens how test-only Docker container names are built for Postgres test fixtures. It replaces a simple slash-to-underscore replacement with a stricter sanitizer that allows only letters, digits, underscores, and hyphens, trims leading/trailing punctuation, adds a random suffix, and falls back to a default name if the input sanitizes to nothing. The goal is to stop concurrent test runs from creating containers with the same name and to avoid invalid Docker names. It is test infrastructure hardening, not a fix for a user-facing vulnerability.
No production action required. Reviewers should confirm RandomDBName(t) is sufficiently random and collision-resistant for the expected degree of test parallelism, and that the sanitizer's allowed character set matches Docker's container name rules. Consider whether any CI/test scripts depend on the old predictable container name format.
Security signals we found
Test fixture container name collision avoided via random suffix
Docker container name input sanitized more strictly
Fallback default name prevents empty/invalid container names
New unit tests added for sanitizer behavior
Evidence from the diff
The patch modifies sqldb/v2/postgres_fixture.go’s NewTestPgFixture and sanitizeDockerName. Previously container names were derived from t.Name() with only ‘/’ replaced by ‘’. The new sanitizer uses strings.Map to map any non-alphanumeric, non-underscore, non-hyphen rune to ‘’, then trims ‘_.-’ from both ends, and returns ‘postgresql-container’ if the result is empty. It also appends RandomDBName(t) to the name to avoid collisions during parallel/concurrent test execution. A unit test file is added to cover the sanitizer. The change only affects test code and Docker container naming; it does not alter production database logic, authentication, or network behavior.
Changed components
sqldb/v2/postgres_fixture.gosqldb/v2/postgres_fixture_test.goInspect captured patch +85 / −5
diff --git a/sqldb/v2/postgres_fixture.go b/sqldb/v2/postgres_fixture.go
index cf11154..6918e3c 100644
--- a/sqldb/v2/postgres_fixture.go
+++ b/sqldb/v2/postgres_fixture.go
@@ -45,8 +45,12 @@ func NewTestPgFixture(t testing.TB, expiry time.Duration) *TestPgFixture {
pool, err := dockertest.NewPool("")
require.NoError(t, err, "Could not connect to docker")
- // Create a predictable container name.
- containerName := sanitizeDockerName(t.Name() + "-postgresql-container")
+ // Create a Docker-safe container name and add a random suffix so
+ // concurrently running tests do not collide.
+ containerName := sanitizeDockerName(
+ fmt.Sprintf("%s-%s-postgresql-container", t.Name(),
+ RandomDBName(t)),
+ )
// Pulls an image, creates a container based on it and runs it.
resource, err := pool.RunWithOptions(&dockertest.RunOptions{
@@ -112,10 +116,33 @@ func NewTestPgFixture(t testing.TB, expiry time.Duration) *TestPgFixture {
return fixture
}
-// sanitizeDockerName returns a Docker-safe container name by replacing
-// disallowed path separators ("/") with underscores.
+// sanitizeDockerName returns a Docker-safe container name.
func sanitizeDockerName(name string) string {
- return strings.ReplaceAll(name, "/", "_")
+ sanitized := strings.Map(func(r rune) rune {
+ switch {
+ case r >= 'a' && r <= 'z':
+ return r
+
+ case r >= 'A' && r <= 'Z':
+ return r
+
+ case r >= '0' && r <= '9':
+ return r
+
+ case r == '_', r == '-':
+ return r
+
+ default:
+ return '_'
+ }
+ }, name)
+
+ sanitized = strings.Trim(sanitized, "_.-")
+ if sanitized == "" {
+ return "postgresql-container"
+ }
+
+ return sanitized
}
// GetConfig returns the full config of the Postgres node.
diff --git a/sqldb/v2/postgres_fixture_test.go b/sqldb/v2/postgres_fixture_test.go
new file mode 100644
index 0000000..4cc086c
--- /dev/null
+++ b/sqldb/v2/postgres_fixture_test.go
@@ -0,0 +1,53 @@
+//go:build !js && !(windows && (arm || 386)) && !(linux && (ppc64 || mips || mipsle || mips64)) && !(netbsd || openbsd)
+
+package sqldb
+
+import (
+ "testing"
+
+ "github.com/stretchr/testify/require"
+)
+
+// TestSanitizeDockerName verifies that invalid Docker name characters are
+// normalized before the fixture creates a container.
+func TestSanitizeDockerName(t *testing.T) {
+ t.Parallel()
+
+ testCases := []struct {
+ name string
+ input string
+ expected string
+ }{
+ {
+ name: "slashes and spaces",
+ input: "TestParent/some case",
+ expected: "TestParent_some_case",
+ },
+ {
+ name: "leading punctuation",
+ input: "---fixture",
+ expected: "fixture",
+ },
+ {
+ name: "trailing punctuation",
+ input: "fixture---",
+ expected: "fixture",
+ },
+ {
+ name: "empty fallback",
+ input: " ",
+ expected: "postgresql-container",
+ },
+ }
+
+ for _, testCase := range testCases {
+ testCase := testCase
+
+ t.Run(testCase.name, func(t *testing.T) {
+ t.Parallel()
+
+ result := sanitizeDockerName(testCase.input)
+ require.Equal(t, testCase.expected, result)
+ })
+ }
+}
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.