Re: Re: [COMMITTERS] pgsql: Prevent the injection of invalidly encoded strings by PL/Python - Mailing list pgsql-hackers

From Peter Eisentraut
Subject Re: Re: [COMMITTERS] pgsql: Prevent the injection of invalidly encoded strings by PL/Python
Date
Msg-id 1269301684.14588.33.camel@vanquo.pezone.net
Whole thread Raw
In response to Re: Re: [COMMITTERS] pgsql: Prevent the injection of invalidly encoded strings by PL/Python  (Tom Lane <tgl@sss.pgh.pa.us>)
List pgsql-hackers
On mån, 2010-03-22 at 19:29 -0400, Tom Lane wrote:
> Peter Eisentraut <peter_e@gmx.net> writes:
> > I have never used Tcl before just now, and the documentation is sketchy,
> > but it looks like the behavior of Tcl is kind of mixed in this area.
> 
> > Escapes such as "\xd0" are apparently converted to Unicode code points
> > rather than bytes when the appropriate OS locale is set.  So that is
> > safe.  Except that it doesn't work in some locale/charset setups, such
> > as EUC_JP.  To adapt Hannu's original example:
> 
> The pltcl code special-cases Unicode IIRC.

You can observe the equivalent behavior in tclsh, so this isn't pltcl at
work here.

One might argue that the leak is really somewhere in Tcl, since it
allows this kind of thing while claiming to use Unicode.  But that
doesn't really help us ...



pgsql-hackers by date:

Previous
From: Josh Berkus
Date:
Subject: Re: 9.0 release notes done
Next
From: Takahiro Itagaki
Date:
Subject: Re: WIP: preloading of ispell dictionary