Changed behaviour of \'

From: Martin Pitt <mpitt(at)debian(dot)org>
To: PostgreSQL Bugs <pgsql-bugs(at)postgresql(dot)org>
Subject: Changed behaviour of \'
Date: 2011-05-10 16:20:23
Message-ID: 20110510162023.GA2490@piware.de
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

Hello again,

sorry for spamming you today, but I promise that this is the last
mail; it's the one remaining test case failure for me.

I have some test cases to verify the handling of the obsolete \'
escaping in different locales (cf. CVE-2006-2313).

Up to 9.0, \' was still allowed in safe locales, but not in unsafe ones (sorry
for German error messages, but they just complain about unsafe usage of \'):

----------------------- 8< ----------------
$ printf "set client_encoding='SJIS'; select '\\\\'a'" | psql -Atq template1
FEHLER: unsichere Verwendung von \' in Zeichenkettenkonstante
LINE 1: select '\'a'
^
HINT: Verwenden Sie '', um Quotes in Zeichenketten zu schreiben. \' ist in bestimmten Client-seitigen Kodierungen unsicher.

$ printf "set client_encoding='UTF8'; select '\\\\'a'" | psql -Atq template1
WARNUNG: nicht standardkonforme Verwendung von \' in Zeichenkettenkonstante
LINE 1: select '\'a'
^
HINT: Verwenden Sie '', um Quotes in Zeichenketten zu schreiben, oder verwenden Sie die Syntax für Escape-Zeichenketten (E'...').
'a
----------------------- 8< ----------------

(Note the last line here, where it outputs 'a).

9.1 still rejects \' in SJIS, but it now also rejects \' in
UTF-8:

----------------------- 8< ----------------
$ printf "set client_encoding='SJIS'; select '\\\\'a'" | psql -Atq template1
ERROR: unterminated quoted string at or near "'"
LINE 1: select '\'a'

$ printf "set client_encoding='UTF8'; select '\\\\'a'" | psql -Atq template1
ERROR: unterminated quoted string at or near "'"
LINE 1: select '\'a'
----------------------- 8< ----------------

Since HISTORY does not mention this, is that an explicit decision to
finally deprecate the old \' syntax (which would be great, as it makes
this thing a lot more robust and deterministic, but it might be worth
mentioning it in HISTORY), or an unintended side effect?

Thanks,

Martin
--
Martin Pitt | http://www.piware.de
Ubuntu Developer (www.ubuntu.com) | Debian Developer (www.debian.org)

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message hubert depesz lubaczewski 2011-05-10 16:37:02 Re: Changed behaviour of \'
Previous Message Tom Lane 2011-05-10 15:38:32 Re: 9.1beta1 "collate" test failure