| From: | Steven Niu <niushiji(at)gmail(dot)com> |
|---|---|
| To: | Peter Smith <smithpb2250(at)gmail(dot)com>, PostgreSQL Hackers <pgsql-hackers(at)lists(dot)postgresql(dot)org> |
| Subject: | Re: PSQL schema "describe" \dn is not escaping quotes |
| Date: | 2026-07-28 08:19:54 |
| Message-ID: | SA5PPF230C70D4BFBD6006437E357AE7CF9A7CB2@SA5PPF230C70D4B.namprd14.prod.outlook.com |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
Hi Peter,
I took a look at your patch. The core fix is correct and
does address the reported crash: the old code built the
query with a raw `'%s'` substitution of the user-supplied pattern,
so a pattern containing a single quote (\dn "it's a bug")
broke out of the string literal and produced a syntax error
on the server.
A few things worth addressing before this is finalized, though:
1. Indentation
if (!validateSQLNamePattern(...))
goto error_return; // should be indented one more tab
2. The new validateSQLNamePattern() call duplicates validation that
already happened.
The validateSQLNamePattern() has been called before your change. Since only the escaping/query-building side effect is actually
needed here. You can call the lower-level processSQLNamePattern() directly and doesn't check its return value, because no additional validation is needed:
processSQLNamePattern(pset.db, &buf, pattern, false, false,
NULL, "n.nspname", NULL,
NULL, NULL, NULL);
Thanks,
Steven
________________________________________
From: Peter Smith <smithpb2250(at)gmail(dot)com>
Sent: Tuesday, July 28, 2026 15:07
To: PostgreSQL Hackers <pgsql-hackers(at)lists(dot)postgresql(dot)org>
Subject: PSQL schema "describe" \dn is not escaping quotes
The psql schema "describe" command (\dn) is not correctly escaping the
schema pattern arg given to it.
This results in an internal SQL error like below:
test_pub=# \dn "it's a bug"
2026-07-28 15:44:55.498 AEST [28319] ERROR: syntax error at or near
"s" at character 251
2026-07-28 15:44:55.498 AEST [28319] STATEMENT: /* Get publications
that publish this schema */
SELECT pubname
FROM pg_catalog.pg_publication p
JOIN pg_catalog.pg_publication_namespace pn ON p.oid = pn.pnpubid
JOIN pg_catalog.pg_namespace n ON n.oid = pn.pnnspid
WHERE n.nspname = '"it's a bug"'
ORDER BY 1
ERROR: syntax error at or near "s"
LINE 6: WHERE n.nspname = '"it's a bug"'
^
~~~
PSA a v1 patch to address this.
~~~
After applying my patch, now you can do stuff like the following:
test_pub=# CREATE SCHEMA "it's working";
CREATE SCHEMA
test_pub=# CREATE PUBLICATION pub1 FOR TABLES IN SCHEMA "it's working";
CREATE PUBLICATION
test_pub=# \dn "it's working"
List of schemas
Name | Owner
--------------+----------
it's working | postgres
Included in publications:
"pub1"
======
Kind Regards,
Peter Smith.
Fujitsu Australia
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Alexander Nestorov | 2026-07-28 08:43:40 | Re: [PATCH] btree_gist: add cross-type integer operator support for GiST |
| Previous Message | Andrei Lepikhov | 2026-07-28 08:13:19 | Re: Do not scan index in right table if condition for left join evaluates to false using columns in left table |