Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 142c24c

Browse files
committed
Reject, in pg_dumpall, names containing CR or LF.
These characters prematurely terminate Windows shell command processing, causing the shell to execute a prefix of the intended command. The chief alternative to rejecting these characters was to bypass the Windows shell with CreateProcess(), but the ability to use such names has little value. Back-patch to 9.1 (all supported versions). This change formally revokes support for these characters in database names and roles names. Don't document this; the error message is self-explanatory, and too few users would benefit. A future major release may forbid creation of databases and roles so named. For now, check only at known weak points in pg_dumpall. Future commits will, without notice, reject affected names from other frontend programs. Also extend the restriction to pg_dumpall --dbname=CONNSTR arguments and --file arguments. Unlike the effects on role name arguments and database names, this does not reflect a broad policy change. A migration to CreateProcess() could lift these two restrictions. Reviewed by Peter Eisentraut. Security: CVE-2016-5424
1 parent c400717 commit 142c24c

File tree

1 file changed

+22
-0
lines changed

1 file changed

+22
-0
lines changed

src/bin/pg_dump/pg_dumpall.c

+22
Original file line numberDiff line numberDiff line change
@@ -2218,6 +2218,12 @@ doConnStrQuoting(PQExpBuffer buf, const char *str)
22182218
/*
22192219
* Append the given string to the shell command being built in the buffer,
22202220
* with suitable shell-style quoting.
2221+
*
2222+
* Forbid LF or CR characters, which have scant practical use beyond designing
2223+
* security breaches. The Windows command shell is unusable as a conduit for
2224+
* arguments containing LF or CR characters. A future major release should
2225+
* reject those characters in CREATE ROLE and CREATE DATABASE, because use
2226+
* there eventually leads to errors here.
22212227
*/
22222228
static void
22232229
doShellQuoting(PQExpBuffer buf, const char *str)
@@ -2228,6 +2234,14 @@ doShellQuoting(PQExpBuffer buf, const char *str)
22282234
appendPQExpBufferChar(buf, '\'');
22292235
for (p = str; *p; p++)
22302236
{
2237+
if (*p == '\n' || *p == '\r')
2238+
{
2239+
fprintf(stderr,
2240+
_("shell command argument contains a newline or carriage return: \"%s\"\n"),
2241+
str);
2242+
exit(EXIT_FAILURE);
2243+
}
2244+
22312245
if (*p == '\'')
22322246
appendPQExpBufferStr(buf, "'\"'\"'");
22332247
else
@@ -2239,6 +2253,14 @@ doShellQuoting(PQExpBuffer buf, const char *str)
22392253
appendPQExpBufferChar(buf, '"');
22402254
for (p = str; *p; p++)
22412255
{
2256+
if (*p == '\n' || *p == '\r')
2257+
{
2258+
fprintf(stderr,
2259+
_("shell command argument contains a newline or carriage return: \"%s\"\n"),
2260+
str);
2261+
exit(EXIT_FAILURE);
2262+
}
2263+
22422264
if (*p == '"')
22432265
appendPQExpBufferStr(buf, "\\\"");
22442266
else

0 commit comments

Comments
 (0)