forked frompostgres/postgres
- Notifications
You must be signed in to change notification settings - Fork1
Tags: mhagander/postgres
Tags
REL9_1_ALPHA1
Install a data-type-based solution for protecting pg_get_expr().Since the code underlying pg_get_expr() is not secure against malformedinput, and can't practically be made so, we need to prevent miscreantsfrom feeding arbitrary data to it. We can do this securely by declaringpg_get_expr() to take a new datatype "pg_node_tree" and declaring thesystem catalog columns that hold nodeToString output to be of that type.There is no way at SQL level to create a non-null value of type pg_node_tree.Since the backend-internal operations that fill those catalog columnsoperate below the SQL level, they are oblivious to the datatype relabelingand don't need any changes.
REL9_0_RC1
tag rc1 ... final stretch ...
PreviousNext