pgsql: Convert newlines to spaces in names written in pg_dump comments.

Поиск
Список
Период
Сортировка
От Tom Lane
Тема pgsql: Convert newlines to spaces in names written in pg_dump comments.
Дата
Msg-id E1S0hiR-00088o-1w@gemulon.postgresql.org
обсуждение исходный текст
Список pgsql-committers
Convert newlines to spaces in names written in pg_dump comments.

pg_dump was incautious about sanitizing object names that are emitted
within SQL comments in its output script.  A name containing a newline
would at least render the script syntactically incorrect.  Maliciously
crafted object names could present a SQL injection risk when the script
is reloaded.

Reported by Heikki Linnakangas, patch by Robert Haas

Security: CVE-2012-0868

Branch
------
REL8_3_STABLE

Details
-------
http://git.postgresql.org/pg/commitdiff/a7f6cb85486b1f3eacd86155af2fdc20a1dc2bec

Modified Files
--------------
src/bin/pg_dump/pg_backup_archiver.c |   60 +++++++++++++++++++++++++++++++--
1 files changed, 56 insertions(+), 4 deletions(-)


В списке pgsql-committers по дате отправления:

Предыдущее
От: Tom Lane
Дата:
Сообщение: pgsql: Require execute permission on the trigger function for CREATE TR
Следующее
От: Tom Lane
Дата:
Сообщение: pgsql: Remove arbitrary limitation on length of common name in SSL cert