Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit3fe8a6c

Browse files
committed
Docs: add disclaimer about hazards of using regexps from untrusted sources.
It's not terribly hard to devise regular expressions that take largeamounts of time and/or memory to process. Recent testing by Greg Stark hasalso shown that machines with small stack limits can be driven to stackoverflow by suitably crafted regexps. While we intend to fix these thingsas much as possible, it's probably impossible to eliminate slow-executioncases altogether. In any case we don't want to treat such things assecurity issues. The history of that code should already discourageprudent DBAs from allowing execution of regexp patterns coming frompossibly-hostile sources, but it seems like a good idea to warn about thehazard explicitly.Currently, similar_escape() allows access to enough of the underlyingregexp behavior that the warning has to apply to SIMILAR TO as well.We might be able to make it safer if we tightened things up to allow onlySQL-mandated capabilities in SIMILAR TO; but that would be a subtlynon-backwards-compatible change, so it requires discussion and probablycould not be back-patched.Per discussion among pgsql-security list.
1 parenta1c4afa commit3fe8a6c

File tree

1 file changed

+22
-0
lines changed

1 file changed

+22
-0
lines changed

‎doc/src/sgml/func.sgml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3074,6 +3074,28 @@ cast(-44 as bit(12)) <lineannotation>111111010100</lineannotation>
30743074
</para>
30753075
</tip>
30763076

3077+
<caution>
3078+
<para>
3079+
While most regular-expression searches can be executed very quickly,
3080+
regular expressions can be contrived that take arbitrary amounts of
3081+
time and memory to process. Be wary of accepting regular-expression
3082+
search patterns from hostile sources. If you must do so, it is
3083+
advisable to impose a statement timeout.
3084+
</para>
3085+
3086+
<para>
3087+
Searches using <function>SIMILAR TO</function> patterns have the same
3088+
security hazards, since <function>SIMILAR TO</function> provides many
3089+
of the same capabilities as <acronym>POSIX</acronym>-style regular
3090+
expressions.
3091+
</para>
3092+
3093+
<para>
3094+
<function>LIKE</function> searches, being much simpler than the other
3095+
two options, are safer to use with possibly-hostile pattern sources.
3096+
</para>
3097+
</caution>
3098+
30773099
<sect2 id="functions-like">
30783100
<title><function>LIKE</function></title>
30793101

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp