Db::list_ref_certificates_by_prefix (used by the CLI for short-ID resolution) builds its match pattern by concatenating the caller's prefix with % and passing it to a LIKE clause.
Because the prefix itself is not escaped, any %, _, or \ characters it contains are interpreted as LIKE wildcards instead of literal characters. A prefix containing those characters can therefore match certificates outside the requested prefix, which makes short-ID resolution return over-broad or incorrect result sets.
Expected: prefix matching treats the prefix literally, so abc% only matches IDs that literally start with abc%.
Fix: escape %, _, and \ in the prefix and add an explicit ESCAPE '\' clause to the query.
Db::list_ref_certificates_by_prefix(used by the CLI for short-ID resolution) builds its match pattern by concatenating the caller's prefix with%and passing it to aLIKEclause.Because the prefix itself is not escaped, any
%,_, or\characters it contains are interpreted asLIKEwildcards instead of literal characters. A prefix containing those characters can therefore match certificates outside the requested prefix, which makes short-ID resolution return over-broad or incorrect result sets.Expected: prefix matching treats the prefix literally, so
abc%only matches IDs that literally start withabc%.Fix: escape
%,_, and\in the prefix and add an explicitESCAPE '\'clause to the query.