Re: Re: [BUGS] BUG #4027: backslash escapingnotdisabled inplpgsql

From: "Kevin Grittner" <Kevin(dot)Grittner(at)wicourts(dot)gov>
To: "Tom Lane" <tgl(at)sss(dot)pgh(dot)pa(dot)us>, "Kevin Grittner" <Kgrittn(dot)CCAP(dot)Courts(at)wicourts(dot)gov>
Cc: "Jonathan Guthrie" <jguthrie(at)brokersys(dot)com>, "Peter Eisentraut" <peter_e(at)gmx(dot)net>, "Bruce Momjian" <bruce(at)momjian(dot)us>, "PostgreSQL-development" <pgsql-hackers(at)postgresql(dot)org>
Subject: Re: Re: [BUGS] BUG #4027: backslash escapingnotdisabled inplpgsql
Date: 2009-04-09 21:10:44
Message-ID: 49DE1E04.EE98.0025.0@wicourts.gov
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-bugs pgsql-hackers

I wrote:
> Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
>> I think you are confusing parsing of the string literal that
>> is the argument of CREATE FUNCTION with the parsing that the
plpgsql
>> interpreter does on the function body once it gets it.

> Oh, I'm not confused about that at all. I'm arguing that it's a bad
> idea.

To be more explicit, I see that there is a third parser phase -- when
the function is planned, the original contents of the character string
literal are passed to the normal PostgreSQL execution engine, which
parses them again, potentially using different rules from those used
by the plpgsql interpreter. I maintain that having the execution
engine use different rules for looking at the value of the literal
than the plpgsql parser used to find the boundaries of the literal
is where the weird corner case bugs come in.

For someone using string literal '\x49\\' in a plpgsql function, the
plpgsql parser sees it as a two character string, but when the
function is actually run, depending on whether the first execution is
using standard string literals, this can be either a two character or
a six character string. Unless the coder of the function uses the SET
option in declaring the function, they don't know what value will be
used at run time, and it may change from run to run.

It seems to me that we already have exactly the kinds of problems you
say you want to avoid, and that there is an obvious fix to avoid them.

-Kevin

In response to

Browse pgsql-bugs by date

  From Date Subject
Next Message Jeff Davis 2009-04-09 21:42:16 Re: possible bug not in open items
Previous Message Kevin Grittner 2009-04-09 19:11:15 Re: Re: [BUGS] BUG #4027: backslash escaping notdisabled inplpgsql

Browse pgsql-hackers by date

  From Date Subject
Next Message Bruce Momjian 2009-04-09 22:32:34 Re: monitoring-stats.html documentation
Previous Message Tom Lane 2009-04-09 19:20:52 Re: GIN versus zero-key queries