pgsql: Further fixes to the pg_get_expr() security fix in back branches - Mailing list pgsql-committers

From Tom Lane
Subject pgsql: Further fixes to the pg_get_expr() security fix in back branches
Date
Msg-id E1Ozc7h-0003NR-5b@gemulon.postgresql.org
Whole thread Raw
List pgsql-committers
Further fixes to the pg_get_expr() security fix in back branches.

It now emerges that the JDBC driver expects to be able to use pg_get_expr()
on an output of a sub-SELECT.  So extend the check logic to be able to recurse
into a sub-SELECT to see if the argument is ultimately coming from an
appropriate column.  Per report from Thomas Kellerer.

Branch
------
REL8_2_STABLE

Details
-------
http://git.postgresql.org/gitweb?p=postgresql.git;a=commitdiff;h=2c875a1deaba78d04e749397b630073d7723c476

Modified Files
--------------
src/backend/parser/parse_func.c |   80 +++++++++++++++++++++++++++------------
1 files changed, 56 insertions(+), 24 deletions(-)


pgsql-committers by date:

Previous
From: Tom Lane
Date:
Subject: pgsql: Further fixes to the pg_get_expr() security fix in back branches
Next
From: Tom Lane
Date:
Subject: pgsql: Further fixes to the pg_get_expr() security fix in back branches