BUG #16282: Avoid sql-injections at identifiers

Поиск
Список
Период
Сортировка
От PG Bug reporting form
Тема BUG #16282: Avoid sql-injections at identifiers
Дата
Msg-id 16282-e9df338a7c1fad9d@postgresql.org
обсуждение исходный текст
Список pgsql-bugs
The following bug has been logged on the website:

Bug reference:      16282
Logged by:          RekGRpth
Email address:      rekgrpth@gmail.com
PostgreSQL version: 12.2
Operating system:   Docker alpine edge
Description:

To avoid sql-injections at identifiers I suggest to create new IDOID type
for PQexecParams (and others libpq) and SPI_execute_with_args (and other
spi) that will bw worked as %I in format command.

Now I need use PQescapeIdentifier for libpq and quote_identifier for spi,
but with new IDOID type I can transfrer identifiers wia args with this type!


В списке pgsql-bugs по дате отправления:

Предыдущее
От: Dean Rasheed
Дата:
Сообщение: Re: BUG #16281: LN() function inaccurate at 1000th fractional digit
Следующее
От: "Serbin, Ilya"
Дата:
Сообщение: Re: BUG #16280: dead tuples (probably) effect plan and query performance