AIKIDO-2026-826020

TL;DR

The string_trim/1 expression in lib/expr.ex compiles to a Postgres REGEXP_REPLACE call intended to strip leading and trailing whitespace. The generated SQL treats \s as a literal space rather than a regex whitespace class, so only ASCII space characters are removed while tabs, newlines, carriage returns, and form feeds survive. Applications that rely on string_trim/1 for trimmed-uniqueness or trimmed-equality checks can be bypassed by submitting values padded with non-space whitespace, which the database treats as distinct from the trimmed in-memory value. The fix generates a pattern that removes all whitespace to match Elixir's String.trim/1.