Noah Misch fcd15f1358 Obstruct shell, SQL, and conninfo injection via database and role names. ... Due to simplistic quoting and confusion of database names with conninfo strings, roles with the CREATEDB or CREATEROLE option could escalate to superuser privileges when a superuser next ran certain maintenance commands. The new coding rule for PQconnectdbParams() calls, documented at conninfo_array_parse(), is to pass expand_dbname=true and wrap literal database names in a trivial connection string. Escape zero-length values in appendConnStrVal(). Back-patch to 9.1 (all supported versions). Nathan Bossart, Michael Paquier, and Noah Misch. Reviewed by Peter Eisentraut. Reported by Nathan Bossart. Security: CVE-2016-5424		2016-08-08 10:07:46 -04:00
..
mbprint.h	Move psql's print.c and mbprint.c into src/fe_utils.	2016-03-24 18:27:28 -04:00
print.h	Support \crosstabview in psql	2016-04-08 20:23:18 -03:00
psqlscan.h	Move psql's psqlscan.l into src/fe_utils.	2016-03-24 20:28:47 -04:00
psqlscan_int.h	Move psql's psqlscan.l into src/fe_utils.	2016-03-24 20:28:47 -04:00
simple_list.h
string_utils.h	Obstruct shell, SQL, and conninfo injection via database and role names.	2016-08-08 10:07:46 -04:00