Re: [PATCHES] Current-stream read for psql's \copy

Поиск
Список
Период
Сортировка
От Tom Lane
Тема Re: [PATCHES] Current-stream read for psql's \copy
Дата
Msg-id 17339.1076434592@sss.pgh.pa.us
обсуждение исходный текст
Список pgsql-hackers
Bruce Momjian <pgman@candle.pha.pa.us> writes:
> I will do it by vote, not because _I_ decide it is unintuitive.  And I
> don't have to talk _you_ into it, just a majority of developers.

[shrug...] Put it to a vote if you want; I feel sure you will lose.

There is another argument in favor of being able to read COPY data from
stdin (ie, not from the command script), which is that it is a security
feature that can help prevent SQL-injection attacks.  In the example ofdata-source-program | psql -f script
the upstream program *cannot* insert any SQL commands, it can only
source data that will go into exactly the table the script specifies.
The workaround you proposed of having the upstream issue COPY for itself
is insecure; it's quite analogous to allowing a user to enter unquoted
data into a SQL command string.
        regards, tom lane


В списке pgsql-hackers по дате отправления:

Предыдущее
От: Andreas Pflug
Дата:
Сообщение: Re: MS SQL features for new version
Следующее
От: Bruce Momjian
Дата:
Сообщение: Re: [PATCHES] Current-stream read for psql's \copy