Re: security bug (with patch-fix) -- need more HTML-escaping for working with tree-nodes

From: Dave Page <dpage(at)pgadmin(dot)org>
To: Ashesh Vashi <ashesh(dot)vashi(at)enterprisedb(dot)com>
Cc: Andrei Antonov <antonov(at)imp-m(dot)ru>, pgadmin-hackers <pgadmin-hackers(at)postgresql(dot)org>
Subject: Re: security bug (with patch-fix) -- need more HTML-escaping for working with tree-nodes
Date: 2017-05-10 07:59:05
Message-ID: CA+OCxoxHMMzgFCQ8hmMx9AtoYcRpVO2KJqLKJNWMf9=KYEJ7qw@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgadmin-hackers

On Wed, May 10, 2017 at 8:56 AM, Ashesh Vashi <ashesh(dot)vashi(at)enterprisedb(dot)com
> wrote:

> Thanks.
> Committed!
>

I agree with the change from a preventative/safety perspective, though I'm
struggling to classify it as a security issue, given that collections are
always named by the code and not from user input.

Am I missing something?

--
Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake

EnterpriseDB UK: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

In response to

Responses

Browse pgadmin-hackers by date

  From Date Subject
Next Message Ashesh Vashi 2017-05-10 08:00:57 Re: security bug (with patch-fix) -- need more HTML-escaping for working with tree-nodes
Previous Message Ashesh Vashi 2017-05-10 07:56:51 Re: security bug (with patch-fix) -- need more HTML-escaping for working with tree-nodes