Disallowing multiple queries per PQexec()

From: Surafel Temesgen <surafel3000(at)gmail(dot)com>
To: pgsql-hackers(at)postgresql(dot)org
Subject: Disallowing multiple queries per PQexec()
Date: 2017-02-27 13:58:19
Message-ID: CALAY4q8dJOfS6eeiSJeM7zGiywPrZQJ-cZC-Teom1FxJm8DCww@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

This assignment is on todo list and has a benefit of providing an
additional defense against SQL-injection attacks. Previous mailing list
discussion is here
<https://www.postgresql.org/message-id/9236.1167968298@sss.pgh.pa.us> and I
attach a small patch that fix the issue by checking whether query string
contains multiple sql commands without being a transaction block or not and
emits appropriate error message in the case of non-transaction block
multiple query string.

This patch tests using psql –c option

i.e. if it’s not a transaction block and have multiple query string ,it
emits appropriate error message.

psql -c 'DECLARE myportal CURSOR FOR select * from pg_database;FETCH ALL in
myportal;CLOSE myportal' postgres

ERROR: cannot execute multiple commands unless it is a transaction block

In a case of transaction block and single command query string it continue
with normal execution

psql -c 'BEGIN;DECLARE myportal CURSOR FOR select * from pg_database;FETCH
ALL in myportal;CLOSE myportal;END' postgres

COMMIT

psql -c 'CREATE TABLE foo();' postgres

CREATE TABLE

Comments?

Regards

Surafel

Attachment Content-Type Size
disallow-multiple-queries-1.patch application/octet-stream 1.6 KB

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Peter Eisentraut 2017-02-27 13:59:36 Re: chomp PQerrorMessage() in backend uses
Previous Message Peter Eisentraut 2017-02-27 13:48:26 Re: Proposal : For Auto-Prewarm.