pgpool: Delimit query-cache key to prevent collisions

From: Taiki Koshino <koshino(at)sraoss(dot)co(dot)jp>
To: pgpool-committers(at)lists(dot)postgresql(dot)org
Subject: pgpool: Delimit query-cache key to prevent collisions
Date: 2026-09-16 08:10:29
Message-ID: E1x6kir-0000000CcBv-12o4@gothos.postgresql.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgpool-committers

Delimit query-cache key to prevent collisions

I have reviewed the patch you provided.
It has also passed all regression tests.

encode_key() constructs the cache key using md5(user || query || database) without delimiters.
This allows different sessions to produce identical keys
(e.g., "admin" + "Q" + "testdb" and "adm" + "Q" + "intestdb"),
leading to data leakage between users/databases.

Changes:
Explicit Delimiters: Insert NUL bytes between the user, query, and database fields in the buffer.
Hash Full Range: Updated the hash function to process the entire byte range (including NUL separators)
instead of stopping at the first NUL byte.

Reported-by: Emond Papegaaij <emond(dot)papegaaij(at)gmail(dot)com>
Reported-by: Claude code
Author: Taiki Koshino <koshino(at)sraoss(dot)co(dot)jp>
Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374DD1C2B89248B8714F84394C22%40TY4PR01MB17374.jpnprd01.prod.outlook.com
Backpatch-through: v4.3

Branch
------
V4_7_STABLE

Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=f070a1181716f817099582201cdc0db18cb34fee

Modified Files
--------------
src/query_cache/pool_memqcache.c | 25 +++++++++++++++++++++----
1 file changed, 21 insertions(+), 4 deletions(-)

Browse pgpool-committers by date

  From Date Subject
Next Message Taiki Koshino 2026-09-16 08:22:47 pgpool: Delimit query-cache key to prevent collisions
Previous Message Taiki Koshino 2026-09-16 08:09:59 pgpool: Delimit query-cache key to prevent collisions