Commit6c3690d

committed

Don't pass strings directly to errdetail() and errhint() - use

%s to unescape them. Fixes a potential security issue (in as yetunreleased code)

1 parent284491e commit6c3690dCopy full SHA for 6c3690d

File tree

-3

lines changed

-3

lines changed

Lines changed: 3 additions & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -8,7 +8,7 @@`
`8`	`8`	`*`
`9`	`9`	`*`
`10`	`10`	`* IDENTIFICATION`
`11`		`- * $PostgreSQL: pgsql/src/pl/plpgsql/src/pl_exec.c,v 1.224 2008/11/05 00:07:54 tgl Exp $`
	`11`	`+ * $PostgreSQL: pgsql/src/pl/plpgsql/src/pl_exec.c,v 1.225 2008/11/20 15:36:22 mha Exp $`
`12`	`12`	`*`
`13`	`13`	`*-------------------------------------------------------------------------`
`14`	`14`	`*/`
`@@ -2538,8 +2538,8 @@ exec_stmt_raise(PLpgSQL_execstate estate, PLpgSQL_stmt_raise stmt)`
`2538`	`2538`	`ereport(stmt->elog_level,`
`2539`	`2539`	`(err_code ?errcode(err_code) :0,`
`2540`	`2540`	`errmsg_internal("%s",err_message),`
`2541`		`- (err_detail!=NULL) ?errdetail(err_detail) :0,`
`2542`		`- (err_hint!=NULL) ?errhint(err_hint) :0));`
	`2541`	`+ (err_detail!=NULL) ?errdetail("%s",err_detail) :0,`
	`2542`	`+ (err_hint!=NULL) ?errhint("%s",err_hint) :0));`
`2543`	`2543`
`2544`	`2544`	`estate->err_text=NULL;/* un-suppress... */`
`2545`	`2545`

Comments

(0)