From: | Robert Haas <robertmhaas(at)gmail(dot)com> |
---|---|
To: | Chapman Flack <chap(at)anastigmatix(dot)net> |
Cc: | PostgreSQL Hackers <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: idea: custom log_line_prefix components besides application_name |
Date: | 2017-05-05 18:20:26 |
Message-ID: | CA+TgmoZZfTeOP1TKtbXfRH45sYYYygHSeZMW_JU38E6q6h4mPA@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Thu, May 4, 2017 at 10:59 AM, Chapman Flack <chap(at)anastigmatix(dot)net> wrote:
> invalid input syntax for integer: "21' && 1=2)) Uni/**/ON
> SEl/**/eCT 0x646665743166657274,0x646665743266657274,
> 0x646665743366657274 -- "
Now that is choice. I wonder what specific database system that's targeting...
> I just wonder if anybody thinks web apps, and therefore this
> scenario, are common enough these days to maybe justify one
> or two more GUCs with their own log_line_prefix escapes, such
> as app_client_addr or app_user. Naturally they would only be
> as reliable as the app setting them, and uninterpreted by
> PostgreSQL itself, and so functionally no different from the
> uninterpreted string already available as application_name.
> The benefit is perhaps to be clearer than just overloading
> application_name to carry two or three pieces of information
> (and perhaps privacy, if you care about app user identities and
> source IPs showing up in ps titles).
>
> Worth considering, or is application_name Good Enough?
I mean, if there were a list of things that needed to propagated that
was (1) lengthy and (2) universally agreed, then we'd probably want
more than one field. But your list is pretty short, so I guess I
don't see why you can't just join them together with a punctuation
mark of your choice and call it good.
I might be missing something, though.
--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company
From | Date | Subject | |
---|---|---|---|
Next Message | Rod Taylor | 2017-05-05 18:48:03 | Re: Row Level Security UPDATE Confusion |
Previous Message | Robert Haas | 2017-05-05 18:11:45 | Re: Not getting error if ALTER SUBSCRIPTION syntax is wrong. |