Willing to fix a PQexec() in libpq module

From: "Wu, Fei" <wufei(dot)fnst(at)cn(dot)fujitsu(dot)com>
To: "pgsql-hackers(at)postgresql(dot)org" <pgsql-hackers(at)postgresql(dot)org>
Cc: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Subject: Willing to fix a PQexec() in libpq module
Date: 2019-03-19 08:18:23
Message-ID: 52E6E0843B9D774C8C73D6CF64402F05621F0FFC@G08CNEXMBPEKD02.g08.fujitsu.local
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Hi,all

On website: https://wiki.postgresql.org/wiki/Todo#libpq
I found that in libpq module,there is a TODO case:
-------------------------------------------------------------------------------
Consider disallowing multiple queries in PQexec() as an additional barrier to SQL injection attacks
-------------------------------------------------------------------------------
I am interested in this one. So ,Had it be fixed?
If not, I am willing to do so.
In manual, I found that:
-----------------------------------------------------------------------------
Unlike PQexec, PQexecParams allows at most one SQL command in the given string. (There can be
semicolons in it, but not more than one nonempty command.) This is a limitation of the underlying
protocol, but has some usefulness as an extra defense against SQL-injection attacks.

-------------------------------------------------------------------------------
Maybe we can fix PQexec() just likes PQexecParams()?

I will try to fix it~

--
Best Regards
-----------------------------------------------------
Wu Fei
DX3
Software Division III
Nanjing Fujitsu Nanda Software Tech. Co., Ltd.(FNST)
ADDR.: No.6 Wenzhu Road, Software Avenue,
Nanjing, 210012, China
TEL : +86+25-86630566-9356
COINS: 7998-9356
FAX: +86+25-83317685
MAIL:wufei(dot)fnst(at)cn(dot)fujitsu(dot)com
http://www.fujitsu.com/cn/fnst/
---------------------------------------------------

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Kyotaro HORIGUCHI 2019-03-19 08:23:42 Re: Proposal to suppress errors thrown by to_reg*()
Previous Message Thomas Munro 2019-03-19 08:01:17 Re: DNS SRV support for LDAP authentication