upstream/postgresql
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-05-21 01:37:50 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
postgresql/src
History
Noah Misch 248a433cd1 Fix SQL injection in logical replication origin checks. 
ALTER SUBSCRIPTION ... REFRESH PUBLICATION interpolates schema and
relation names into SQL without quoting them.  A crafted subscriber
relation name can inject arbitrary SQL on the publisher.  Test such a
name.  Back-patch to v16, where commit
8756930190 first appeared.

Reported-by: Pavel Kohout <pavel.kohout@aisle.com>
Author: Pavel Kohout <pavel.kohout@aisle.com>
Reviewed-by: Nathan Bossart <nathandbossart@gmail.com>
Backpatch-through: 16
Security: CVE-2026-6638
2026-05-11 05:13:50 -07:00
..
backend Fix SQL injection in logical replication origin checks. 2026-05-11 05:13:50 -07:00
bin Translation updates 2026-05-11 13:07:36 +02:00
common Unify src/common/'s definitions of MaxAllocSize. 2026-05-11 05:13:49 -07:00
fe_utils In fmtIdEnc(), handle failure of enlargePQExpBuffer(). 2025-02-16 12:46:35 -05:00
include Add timingsafe_bcmp(), for constant-time memory comparison 2026-05-11 05:13:49 -07:00
interfaces Apply timingsafe_bcmp() in authentication paths 2026-05-11 05:13:49 -07:00
makefiles Use --strip-unneeded when stripping static libraries with GNU strip. 2023-04-20 18:12:32 -04:00
pl Make plpgsql_trap test more robust and less resource-intensive. 2026-04-21 10:54:39 -04:00
port Add timingsafe_bcmp(), for constant-time memory comparison 2026-05-11 05:13:49 -07:00
template Use unnamed POSIX semaphores on Cygwin. 2023-01-06 10:33:28 +13:00
test Fix SQL injection in logical replication origin checks. 2026-05-11 05:13:50 -07:00
timezone Update time zone data files to tzdata release 2026b. 2026-04-24 12:28:35 -04:00
tools Add timingsafe_bcmp(), for constant-time memory comparison 2026-05-11 05:13:49 -07:00
tutorial Pre-beta mechanical code beautification. 2023-05-19 17:24:48 -04:00
.gitignore
DEVELOPERS
Makefile Integrate pg_bsd_indent into our build/test infrastructure. 2023-02-12 12:22:21 -05:00
Makefile.global.in Don't put library-supplied -L/-I switches before user-supplied ones. 2025-07-29 15:17:41 -04:00
Makefile.shlib Stop using "-multiply_defined suppress" on macOS. 2023-09-26 21:06:21 -04:00
meson.build Integrate pg_bsd_indent into our build/test infrastructure. 2023-02-12 12:22:21 -05:00
nls-global.mk Fix update-po for the PGXS case 2025-10-16 20:21:05 +02:00