Re: [patch] fix dblink security hole

Поиск
Список
Период
Сортировка
От Tom Lane
Тема Re: [patch] fix dblink security hole
Дата
Msg-id 26668.1222053916@sss.pgh.pa.us
обсуждение исходный текст
Ответ на Re: [patch] fix dblink security hole  (Joe Conway <mail@joeconway.com>)
Ответы Re: [patch] fix dblink security hole
Список pgsql-hackers
Joe Conway <mail@joeconway.com> writes:
> New patch attached.

erm ... wait a minute.  This approach doesn't actually solve the problem
at all, because conninfo_parse is responsible for filling in various
sorts of default values.  In particular it would happily pull a password
from the services file or the PGPASSWORD environment variable, and
looking at the array after the fact doesn't tell whether that happened.

Refactoring doesn't seem like an easy way to fix this, because of the
problem that the behavior of pulling up defaults is part of the API
specification for PQconndefaults().

Thoughts?
        regards, tom lane


В списке pgsql-hackers по дате отправления:

Предыдущее
От: Tom Lane
Дата:
Сообщение: Re: [patch] fix dblink security hole
Следующее
От: Joe Conway
Дата:
Сообщение: Re: [patch] fix dblink security hole