| From: | Taiki Koshino <koshino(at)sraoss(dot)co(dot)jp> |
|---|---|
| To: | pgpool-committers(at)lists(dot)postgresql(dot)org |
| Subject: | pgpool: Delimit query-cache key to prevent collisions |
| Date: | 2026-09-16 08:10:29 |
| Message-ID: | E1x6kir-0000000CcBv-12o4@gothos.postgresql.org |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgpool-committers |
Delimit query-cache key to prevent collisions
I have reviewed the patch you provided.
It has also passed all regression tests.
encode_key() constructs the cache key using md5(user || query || database) without delimiters.
This allows different sessions to produce identical keys
(e.g., "admin" + "Q" + "testdb" and "adm" + "Q" + "intestdb"),
leading to data leakage between users/databases.
Changes:
Explicit Delimiters: Insert NUL bytes between the user, query, and database fields in the buffer.
Hash Full Range: Updated the hash function to process the entire byte range (including NUL separators)
instead of stopping at the first NUL byte.
Reported-by: Emond Papegaaij <emond(dot)papegaaij(at)gmail(dot)com>
Reported-by: Claude code
Author: Taiki Koshino <koshino(at)sraoss(dot)co(dot)jp>
Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374DD1C2B89248B8714F84394C22%40TY4PR01MB17374.jpnprd01.prod.outlook.com
Backpatch-through: v4.3
Branch
------
V4_7_STABLE
Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=f070a1181716f817099582201cdc0db18cb34fee
Modified Files
--------------
src/query_cache/pool_memqcache.c | 25 +++++++++++++++++++++----
1 file changed, 21 insertions(+), 4 deletions(-)
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Taiki Koshino | 2026-09-16 08:22:47 | pgpool: Delimit query-cache key to prevent collisions |
| Previous Message | Taiki Koshino | 2026-09-16 08:09:59 | pgpool: Delimit query-cache key to prevent collisions |