NotificationsYou must be signed in to change notification settings
Fork5
Star26

Commitec3aebd

committed

Reject, in pg_dumpall, names containing CR or LF.

These characters prematurely terminate Windows shell command processing,causing the shell to execute a prefix of the intended command. Thechief alternative to rejecting these characters was to bypass theWindows shell with CreateProcess(), but the ability to use such nameshas little value. Back-patch to 9.1 (all supported versions).This change formally revokes support for these characters in databasenames and roles names. Don't document this; the error message isself-explanatory, and too few users would benefit. A future majorrelease may forbid creation of databases and roles so named. For now,check only at known weak points in pg_dumpall. Future commits will,without notice, reject affected names from other frontend programs.Also extend the restriction to pg_dumpall --dbname=CONNSTR arguments and--file arguments. Unlike the effects on role name arguments anddatabase names, this does not reflect a broad policy change. Amigration to CreateProcess() could lift these two restrictions.Reviewed by Peter Eisentraut.Security:CVE-2016-5424

1 parent640768c commitec3aebdCopy full SHA for ec3aebd

File tree

1 file changed

+22

-0

lines changed

src/bin/pg_dump
- pg_dumpall.c

1 file changed

+22

-0

lines changed

`‎src/bin/pg_dump/pg_dumpall.c`

Lines changed: 22 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -2130,6 +2130,12 @@ doConnStrQuoting(PQExpBuffer buf, const char *str)`
`2130`	`2130`	`/*`
`2131`	`2131`	`* Append the given string to the shell command being built in the buffer,`
`2132`	`2132`	`* with suitable shell-style quoting.`
	`2133`	`+ *`
	`2134`	`+ * Forbid LF or CR characters, which have scant practical use beyond designing`
	`2135`	`+ * security breaches. The Windows command shell is unusable as a conduit for`
	`2136`	`+ * arguments containing LF or CR characters. A future major release should`
	`2137`	`+ * reject those characters in CREATE ROLE and CREATE DATABASE, because use`
	`2138`	`+ * there eventually leads to errors here.`
`2133`	`2139`	`*/`
`2134`	`2140`	`staticvoid`
`2135`	`2141`	`doShellQuoting(PQExpBufferbuf,constchar*str)`
`@@ -2140,6 +2146,14 @@ doShellQuoting(PQExpBuffer buf, const char *str)`
`2140`	`2146`	`appendPQExpBufferChar(buf,'\'');`
`2141`	`2147`	`for (p=str;*p;p++)`
`2142`	`2148`	`{`
	`2149`	`+if (p=='\n'\|\|p=='\r')`
	`2150`	`+{`
	`2151`	`+fprintf(stderr,`
	`2152`	`+_("shell command argument contains a newline or carriage return: \"%s\"\n"),`
	`2153`	`+str);`
	`2154`	`+exit(EXIT_FAILURE);`
	`2155`	`+}`
	`2156`	`+`
`2143`	`2157`	`if (*p=='\'')`
`2144`	`2158`	`appendPQExpBufferStr(buf,"'\"'\"'");`
`2145`	`2159`	`else`
`@@ -2151,6 +2165,14 @@ doShellQuoting(PQExpBuffer buf, const char *str)`
`2151`	`2165`	`appendPQExpBufferChar(buf,'"');`
`2152`	`2166`	`for (p=str;*p;p++)`
`2153`	`2167`	`{`
	`2168`	`+if (p=='\n'\|\|p=='\r')`
	`2169`	`+{`
	`2170`	`+fprintf(stderr,`
	`2171`	`+_("shell command argument contains a newline or carriage return: \"%s\"\n"),`
	`2172`	`+str);`
	`2173`	`+exit(EXIT_FAILURE);`
	`2174`	`+}`
	`2175`	`+`
`2154`	`2176`	`if (*p=='"')`
`2155`	`2177`	`appendPQExpBufferStr(buf,"\\\"");`
`2156`	`2178`	`else`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commitec3aebd

File tree

1 file changed

1 file changed

`‎src/bin/pg_dump/pg_dumpall.c`

0 commit comments