Thread: pgsql-server/src/interfaces/jdbc/org/postgresq ...

CVSROOT:    /cvsroot
Module name:    pgsql-server
Changes by:    barry@svr1.postgresql.org    03/08/07 01:03:13

Modified files:
    src/interfaces/jdbc/org/postgresql/jdbc1:
                                              AbstractJdbc1Statement.java

Log message:
    Sometimes the third time is the charm.  Third try to fix the sql injection
    vulnerability.  This fix completely removes the ability (hack) of being able
    to bind a list of values in an in clause.  It was demonstrated that by allowing
    that functionality you open up the possibility for certain types of
    sql injection attacks.  The previous fix attempts all focused on preventing
    the insertion of additional sql statements (the semi-colon problem:
    xxx; any new sql statement here).  But that still left the ability to
    change the where clause on the current statement or perform a subselect
    which can circumvent applicaiton security logic and/or allow you to call
    any stored function.

    Modified Files:
    jdbc/org/postgresql/jdbc1/AbstractJdbc1Statement.java