upstream/postgresql
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-04-12 12:36:49 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
postgresql/src/bin/psql
History
Noah Misch 098fb00799 Ignore attempts to \gset into specially treated variables. 
If an interactive psql session used \gset when querying a compromised
server, the attacker could execute arbitrary code as the operating
system account running psql.  Using a prefix not found among specially
treated variables, e.g. every lowercase string, precluded the attack.
Fix by issuing a warning and setting no variable for the column in
question.  Users wanting the old behavior can use a prefix and then a
meta-command like "\set HISTSIZE :prefix_HISTSIZE".  Back-patch to 9.5
(all supported versions).

Reviewed by Robert Haas.  Reported by Nick Cleaton.

Security: CVE-2020-25696
2020-11-09 07:32:09 -08:00
..
po Translation updates 2020-05-18 12:49:30 +02:00
t Improve psql's tab completion for filenames. 2020-01-23 11:07:12 -05:00
.gitignore Add basic TAP tests for psql's tab-completion logic. 2020-01-02 15:02:21 -05:00
command.c Allow psql to re-use connection parameters after a connection loss. 2020-10-23 17:07:15 -04:00
command.h Allow psql's \g and \gx commands to transiently change \pset options. 2020-04-07 17:46:29 -04:00
common.c Ignore attempts to \gset into specially treated variables. 2020-11-09 07:32:09 -08:00
common.h Update copyrights for 2020 2020-01-01 12:21:45 -05:00
copy.c Canonicalize some URLs 2020-02-10 20:47:50 +01:00
copy.h Update copyrights for 2020 2020-01-01 12:21:45 -05:00
create_help.pl Improve formatting of create_help.pl and plperl_opmask.pl output. 2020-09-16 20:31:37 -04:00
crosstabview.c Update copyrights for 2020 2020-01-01 12:21:45 -05:00
crosstabview.h Update copyrights for 2020 2020-01-01 12:21:45 -05:00
describe.c Allow psql to re-use connection parameters after a connection loss. 2020-10-23 17:07:15 -04:00
describe.h Improvements to psql \dAo and \dAp commands 2020-07-13 18:53:20 +03:00
help.c psql: Format \? output a little better 2020-06-07 16:12:05 +02:00
help.h Update copyrights for 2020 2020-01-01 12:21:45 -05:00
input.c Update copyrights for 2020 2020-01-01 12:21:45 -05:00
input.h Update copyrights for 2020 2020-01-01 12:21:45 -05:00
large_obj.c Update copyrights for 2020 2020-01-01 12:21:45 -05:00
large_obj.h Update copyrights for 2020 2020-01-01 12:21:45 -05:00
mainloop.c Initial pgindent and pgperltidy run for v13. 2020-05-14 13:06:50 -04:00
mainloop.h Update copyrights for 2020 2020-01-01 12:21:45 -05:00
Makefile Add basic TAP tests for psql's tab-completion logic. 2020-01-02 15:02:21 -05:00
nls.mk Add missing source files to nls.mk 2020-06-06 19:56:21 +02:00
prompt.c psql: Remove one use of HAVE_UNIX_SOCKETS 2020-02-10 19:27:05 +01:00
prompt.h Update copyrights for 2020 2020-01-01 12:21:45 -05:00
psqlrc.sample Improve FILES section of psql reference page. 2014-01-14 19:27:57 -05:00
psqlscanslash.h Update copyrights for 2020 2020-01-01 12:21:45 -05:00
psqlscanslash.l Use mode "r" for popen() in psql's evaluate_backtick(). 2020-10-28 14:35:53 -04:00
settings.h Allow psql to re-use connection parameters after a connection loss. 2020-10-23 17:07:15 -04:00
startup.c Fix redundant error messages in client tools 2020-11-07 23:03:54 +01:00
stringutils.c Improve psql's tab completion for filenames. 2020-01-23 11:07:12 -05:00
stringutils.h Improve psql's tab completion for filenames. 2020-01-23 11:07:12 -05:00
tab-complete.c Track collation versions for indexes. 2020-11-03 01:19:50 +13:00
tab-complete.h Update copyrights for 2020 2020-01-01 12:21:45 -05:00
variables.c Ignore attempts to \gset into specially treated variables. 2020-11-09 07:32:09 -08:00
variables.h Ignore attempts to \gset into specially treated variables. 2020-11-09 07:32:09 -08:00