Skip site navigation (1) Skip section navigation (2)

Re: syntax error causes crafted data to be executed in shell

From: Bruce Momjian <pgman(at)candle(dot)pha(dot)pa(dot)us>
To: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Cc: "Thomer M(dot) Gil" <postgresql(at)thomer(dot)com>,pgsql-bugs(at)postgresql(dot)org, Peter Eisentraut <peter_e(at)gmx(dot)net>
Subject: Re: syntax error causes crafted data to be executed in shell
Date: 2004-12-18 04:05:10
Message-ID: 200412180405.iBI45AS07673@candle.pha.pa.us (view raw or flat)
Thread:
Lists: pgsql-bugs
Tom Lane wrote:
> I wrote:
> > Still, it looks like it would be relatively easy to suppress evaluation
> > of backticked arguments once we recognize that the backslash command has
> > failed, and I would say that that's a reasonable change to make on the
> > principle of least surprise.
> 
> On looking at this further, I wonder if it wouldn't be a good idea for
> a failed backslash command to cause the rest of the input line to be
> discarded.  In the existing coding, if we find another backslash we'll
> try to execute another backslash command, but that seems rather
> considerably likely to be the Wrong Thing instead of the Right Thing.

Tom, would you show an example of the change in behavior? I didn't
understand the details.

-- 
  Bruce Momjian                        |  http://candle.pha.pa.us
  pgman(at)candle(dot)pha(dot)pa(dot)us               |  (610) 359-1001
  +  If your life is a hard drive,     |  13 Roberts Road
  +  Christ can be your backup.        |  Newtown Square, Pennsylvania 19073

In response to

Responses

pgsql-bugs by date

Next:From: Ken JohansonDate: 2004-12-18 04:14:26
Subject: Re: BUG #1350: Backslash ecape charcter violates ISO/ANSI
Previous:From: Bruce MomjianDate: 2004-12-18 03:51:14
Subject: Re: BUG #1350: Backslash ecape charcter violates ISO/ANSI

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group