From: | David Fetter <david(at)fetter(dot)org> |
---|---|
To: | Charles Pritchard <chuck(at)jumis(dot)com> |
Cc: | Alvaro Herrera <alvherre(at)commandprompt(dot)com>, pgsql-hackers <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: W3C Specs: Web SQL |
Date: | 2010-11-08 22:07:33 |
Message-ID: | 20101108220733.GA17202@fetter.org |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Mon, Nov 08, 2010 at 10:36:16AM -0800, Charles Pritchard wrote:
> On 11/8/2010 7:55 AM, Alvaro Herrera wrote:
> >Excerpts from Charles Pritchard's message of sáb nov 06 23:20:13 -0300 2010:
> >
> >>Simple async sql sub-set (the spec in trouble):
> >>http://dev.w3.org/html5/webdatabase/
> >This is insane. This spec allows the server to run arbitrary SQL
> >commands on the client, AFAICT. That seems like infinite joy for
> >malicious people running webservers. The more powerful the dialect
> >of SQL the client implements, the more dangerous it is.
>
> Because of a lack of "interested implementers", the spec does not
> put forward a standard dialect/subset. It simply uses Sqlite.
>
> Obviously, access should be restricted per the security section: a
> given domain may only run commands that modify its own database.
That's not proof against a DoS of the form:
SELECT * FROM generate_series(1,1000000),generate_series(1,1000000),...;
... and that was *before* CTEs made SQL Turing-complete.
Cheers,
David.
--
David Fetter <david(at)fetter(dot)org> http://fetter.org/
Phone: +1 415 235 3778 AIM: dfetter666 Yahoo!: dfetter
Skype: davidfetter XMPP: david(dot)fetter(at)gmail(dot)com
iCal: webcal://www.tripit.com/feed/ical/people/david74/tripit.ics
Remember to vote!
Consider donating to Postgres: http://www.postgresql.org/about/donate
From | Date | Subject | |
---|---|---|---|
Next Message | Kevin Grittner | 2010-11-08 22:30:54 | Re: W3C Specs: Web SQL |
Previous Message | Michael Glaesemann | 2010-11-08 22:00:42 | Re: Removing pgsql_tmp files |