From 5547e2c559fa652eb7c93ab1b5b589c7b9d550a8 Mon Sep 17 00:00:00 2001 From: Philip Hazel Date: Fri, 30 Jun 2006 13:57:46 +0000 Subject: [PATCH] Change ${quote_pgsql to quote ' as '' instead of \' because of a security issue. --- doc/doc-txt/ChangeLog | 7 ++++++- src/src/lookups/pgsql.c | 19 +++++++++++++++++-- test/scripts/9200-PostgreSQL/9200 | 1 + test/stderr/9200 | 13 ++++++++++++- test/stdout/9200 | 1 + 5 files changed, 37 insertions(+), 4 deletions(-) diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index 348c279a1..ea9472d2b 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -1,4 +1,4 @@ -$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.363 2006/06/28 16:00:23 ph10 Exp $ +$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.364 2006/06/30 13:57:46 ph10 Exp $ Change log file for Exim from version 4.21 ------------------------------------------- @@ -56,6 +56,11 @@ PH/06 Added acl_not_smtp_start, based on Johannes Berg's patch, and set the bit to forbid control=suppress_local_fixups in the acl_not_smtp ACL, because it is too late at that time, and has no effect. +PH/07 Changed ${quote_pgsql to quote ' as '' instead of \' because of a + security issue with \' (bugzilla #107). I could not use the + PQescapeStringConn() function, because it needs a PGconn value as one of + its arguments. + Exim version 4.62 ----------------- diff --git a/src/src/lookups/pgsql.c b/src/src/lookups/pgsql.c index 207422c6d..caefeef18 100644 --- a/src/src/lookups/pgsql.c +++ b/src/src/lookups/pgsql.c @@ -1,4 +1,4 @@ -/* $Cambridge: exim/src/src/lookups/pgsql.c,v 1.4 2006/02/07 11:19:01 ph10 Exp $ */ +/* $Cambridge: exim/src/src/lookups/pgsql.c,v 1.5 2006/06/30 13:57:46 ph10 Exp $ */ /************************************************* * Exim - an Internet mail transport agent * @@ -422,6 +422,16 @@ to allow escaping "on spec". If you use something like "where id="ab\%cd" it does treat the string as "ab%cd". So we can safely quote percent and underscore. [This is different to MySQL, where you can't do this.] +The original code quoted single quotes as \' which is documented as valid in +the O'Reilly book "Practical PostgreSQL" (first edition) as an alternative to +the SQL standard '' way of representing a single quote as data. However, in +June 2006 there was some security issue with using \' and so this has been +changed. + +[Note: There is a function called PQescapeStringConn() that quotes strings. +This cannot be used because it needs a PGconn argument (the connection handle). +Why, I don't know. Seems odd for just string escaping...] + Arguments: s the string to be quoted opt additional option text or NULL if none @@ -447,7 +457,12 @@ t = quoted = store_get(Ustrlen(s) + count + 1); while ((c = *s++) != 0) { - if (Ustrchr("\n\t\r\b\'\"\\%_", c) != NULL) + if (c == '\'') + { + *t++ = '\''; + *t++ = '\''; + } + else if (Ustrchr("\n\t\r\b\"\\%_", c) != NULL) { *t++ = '\\'; switch(c) diff --git a/test/scripts/9200-PostgreSQL/9200 b/test/scripts/9200-PostgreSQL/9200 index 2fd81f5e4..c4440a89e 100644 --- a/test/scripts/9200-PostgreSQL/9200 +++ b/test/scripts/9200-PostgreSQL/9200 @@ -9,6 +9,7 @@ ${lookup pgsql {delete from them where id='nonexist';}} ${lookup pgsql {select * from them where id='quote2';}} ${lookup pgsql {select * from them where id='newline';}} ${lookup pgsql {select * from them where id='tab';}} +${lookup pgsql {select * from them where name='${quote_pgsql:'stquot}';}} **** exim -d -bh 10.0.0.0 mail from: diff --git a/test/stderr/9200 b/test/stderr/9200 index 1a004b30f..593ec4d9c 100644 --- a/test/stderr/9200 +++ b/test/stderr/9200 @@ -100,7 +100,18 @@ internal_search_find: file="NULL" database lookup required for select * from them where id='tab'; PGSQL query: select * from them where id='tab'; PGSQL using cached connection for localhost/test/CALLER -lookup yielded: name="x x" id=tab +lookup yielded: name="x x" id=tab +search_open: pgsql "NULL" + cached open +search_find: file="NULL" + key="select * from them where name='''stquot';" partial=-1 affix=NULL starflags=0 +LRU list: +internal_search_find: file="NULL" + type=pgsql key="select * from them where name='''stquot';" +database lookup required for select * from them where name='''stquot'; +PGSQL query: select * from them where name='''stquot'; +PGSQL using cached connection for localhost/test/CALLER +lookup yielded: name='stquot id=quote1 search_tidyup called close PGSQL connection: localhost/test/CALLER >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>> diff --git a/test/stdout/9200 b/test/stdout/9200 index 833f670ce..4b97f9f71 100644 --- a/test/stdout/9200 +++ b/test/stdout/9200 @@ -8,6 +8,7 @@ > name="before after" id=newline > name="x x" id=tab +> name='stquot id=quote1 > **** SMTP testing session as if from host 10.0.0.0 -- 2.25.1