Possible problem with PQescapeStringConn and standard_conforming_strings

From: Jeff Davis <pgsql(at)j-davis(dot)com>
To: pgsql-general(at)postgresql(dot)org
Subject: Possible problem with PQescapeStringConn and standard_conforming_strings
Date: 2006-10-26 23:19:38
Message-ID: 1161904778.31124.118.camel@dogma.v10.wvs
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general


You can set standard_conforming_strings in postgresql.conf at any time
and reload the config, changing the value for all active connections.

That means that if a client opens a connection, and you SIGHUP postgres,
and then the client issues a PQescapeStringConn, the client will get an
incorrectly-escaped string.

This could be a security vulnerability. Webservers which hold open
connections for long periods of time could be incorrectly escaping
values for long periods of time -- between the SIGHUP that changed
standard_conforming_strings, and the time the connection is closed.

Should we change standard_conforming_strings so that it only takes
effect on new connections (or server restart, if we must)? Are there
other similar settings that affect PQescapeStringConn?

Regards,
Jeff Davis

Responses

Browse pgsql-general by date

  From Date Subject
Next Message Jeff Davis 2006-10-26 23:21:24 Re: Possible problem with PQescapeStringConn and
Previous Message Andrew Sullivan 2006-10-26 22:21:12 Re: Compiling ELF 64-bit on Solaris