Skip site navigation (1) Skip section navigation (2)

pgsql: Convert newlines to spaces in names written in pg_dumpcomments.

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: pgsql-committers(at)postgresql(dot)org
Subject: pgsql: Convert newlines to spaces in names written in pg_dumpcomments.
Date: 2012-02-23 23:04:46
Message-ID: E1S0hiQ-00088X-Pf@gemulon.postgresql.org (view raw or flat)
Thread:
Lists: pgsql-committers
Convert newlines to spaces in names written in pg_dump comments.

pg_dump was incautious about sanitizing object names that are emitted
within SQL comments in its output script.  A name containing a newline
would at least render the script syntactically incorrect.  Maliciously
crafted object names could present a SQL injection risk when the script
is reloaded.

Reported by Heikki Linnakangas, patch by Robert Haas

Security: CVE-2012-0868

Branch
------
REL8_4_STABLE

Details
-------
http://git.postgresql.org/pg/commitdiff/d975e166052e5992e1d082273f5680e85239b935

Modified Files
--------------
src/bin/pg_dump/pg_backup_archiver.c |   60 +++++++++++++++++++++++++++++++--
1 files changed, 56 insertions(+), 4 deletions(-)

pgsql-committers by date

Next:From: Tom LaneDate: 2012-02-23 23:04:47
Subject: pgsql: Convert newlines to spaces in names written in pg_dumpcomments.
Previous:From: Tom LaneDate: 2012-02-23 23:04:45
Subject: pgsql: Convert newlines to spaces in names written in pg_dumpcomments.

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group