pgsql: Convert newlines to spaces in names written in pg_dump comments.

Started by Tom Laneover 14 years ago1 messagescomitters
Jump to latest
#1Tom Lane
tgl@sss.pgh.pa.us

Convert newlines to spaces in names written in pg_dump comments.

pg_dump was incautious about sanitizing object names that are emitted
within SQL comments in its output script. A name containing a newline
would at least render the script syntactically incorrect. Maliciously
crafted object names could present a SQL injection risk when the script
is reloaded.

Reported by Heikki Linnakangas, patch by Robert Haas

Security: CVE-2012-0868

Branch
------
master

Details
-------
http://git.postgresql.org/pg/commitdiff/89e0bac86dbca40dfc321926205f2a90d3da5437

Modified Files
--------------
src/bin/pg_dump/pg_backup_archiver.c | 60 +++++++++++++++++++++++++++++++--
1 files changed, 56 insertions(+), 4 deletions(-)