Re: [SECURITY] DoS attack on backend possible - Mailing list pgsql-hackers

From Zeugswetter Andreas SB SD
Subject Re: [SECURITY] DoS attack on backend possible
Date
Msg-id 46C15C39FEB2C44BA555E356FBCD6FA4961E4F@m0114.s-mxs.net
Whole thread Raw
Responses Re: [SECURITY] DoS attack on backend possible  (Florian Weimer <Weimer@CERT.Uni-Stuttgart.DE>)
List pgsql-hackers
> > with Perl and *using placeholders and bind values*, the application
> > developer has not to worry about this. So, usually I don't check the
> > values in my applications (e.g. if only values between 1 and 5 are
> > allowed and under normal circumstances only these are possible), it's the
> > task of the database (check constraint).
>
> That's the idea.  It's the job of the database to guarantee data
> integrety.

Yes, but what is currently missing is a protocol to the backend
where a statement is prepared with placeholders and then executed
(multiple times) with given values. Then there is no doubt what is a
value, and what a part of the SQL.

I think that this would be a wanted feature of the next
protocol version. iirc the backend side part is currently beeing
implemented.

Andreas


pgsql-hackers by date:

Previous
From: Lamar Owen
Date:
Subject: Re: @(#) Mordred Labs advisory 0x0001: Buffer overflow in
Next
From: Tom Lane
Date:
Subject: Re: @(#) Mordred Labs advisory 0x0001: Buffer overflow in