Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d8NHv-0007mR-0x for pgadmin-hackers@arkaria.postgresql.org; Wed, 10 May 2017 08:48:03 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84_2) (envelope-from ) id 1d8NHu-0006AV-Ji for pgadmin-hackers@arkaria.postgresql.org; Wed, 10 May 2017 08:48:02 +0000 Received: from makus.postgresql.org ([2001:4800:1501:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1d8NHg-0005lk-9L for pgadmin-hackers@postgresql.org; Wed, 10 May 2017 08:47:48 +0000 Received: from mail-io0-x231.google.com ([2607:f8b0:4001:c06::231]) by makus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.84_2) (envelope-from ) id 1d8NHd-0001V7-3l for pgadmin-hackers@postgresql.org; Wed, 10 May 2017 08:47:47 +0000 Received: by mail-io0-x231.google.com with SMTP id k91so9079200ioi.1 for ; Wed, 10 May 2017 01:47:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=enterprisedb-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Ubuqkgqx63kk9q499HpSwBTCXsovvNTTRSC7nGHQLbI=; b=r4r9B9uqycCUNjQF/243Bvcs151iqbzKsh4F47NGUdgwI05bzIe85hI1jRAunD2Cbl Vasb/zeiMZhXbi6D5mnffB9lEysRRk2ttuTk5byt76lpIz37m2AyQyzLIrw0vvb7tTRN p2Qh3wZpJP0GqOAx4jQIckofz1cY9f1qy7jV1hRJLkFLpFxW7PcAEaz3lml2/7k/8U25 EdXUOCjoxYnPzByMklKTZWFtziEp0xC8u/EmsDKe5sTl5qtWXDDCA1rW0GXj8zSIOwh3 HVQ8mgwKrFqOLUJFVM1fo87ERO8bnbtZjM4k4m4cB8FM8JV8MJqyAlQmoJ/l7AkR9b31 7tPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Ubuqkgqx63kk9q499HpSwBTCXsovvNTTRSC7nGHQLbI=; b=oiC5cTYmG74RCS4SovetjllQNsX9h+sjsbZwBy7NV3R2jW2x1QG2LJYk+mf8uTwphT q0lbHaQwhQ0q/tFSVF90JOOwcJNlx8P0glt7hfyaHNCD5fKkfquAeMrwYLHbzy8gRQ/y v1Kyl1Fk8b4F1xJ0GPR4+ksTD8QzJAy9TshyQ98gPnpIRtWm7xhTV4itHY6MjzIrRoy2 aHk+NnntQ3Wgp5KbXH08rM2VXjFl6Q6G7bsGbC7vi/uRrLXTzGwFFOpHpdRK1gep52lf PJMDadlG9+7+FIiR6+x8LkjO3VwpyPcuwnEosKWPHR7BtznolsaeZ9alvFHNVhfm+XB7 cqQA== X-Gm-Message-State: AODbwcDjp6EhamrRcj0fW6NI9z3utpNW6QH3faXNAxlE8QQ7Dedc5wL4 BAS7LbGgWEZJFxn/Lgxjq66IOYPiEktX X-Received: by 10.107.48.144 with SMTP id w138mr2525869iow.30.1494406064274; Wed, 10 May 2017 01:47:44 -0700 (PDT) MIME-Version: 1.0 Received: by 10.107.133.155 with HTTP; Wed, 10 May 2017 01:47:42 -0700 (PDT) Received: by 10.107.133.155 with HTTP; Wed, 10 May 2017 01:47:42 -0700 (PDT) In-Reply-To: References: From: Ashesh Vashi Date: Wed, 10 May 2017 14:17:42 +0530 Message-ID: Subject: Re: security bug (with patch-fix) -- need more HTML-escaping for working with tree-nodes To: Dave Page Cc: Andrei Antonov , pgadmin-hackers Content-Type: multipart/alternative; boundary=001a11444bd49c912d054f2786e7 X-Pg-Spam-Score: -2.6 (--) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgadmin-hackers Precedence: bulk Sender: pgadmin-hackers-owner@postgresql.org --001a11444bd49c912d054f2786e7 Content-Type: text/plain; charset=UTF-8 Sure - I will create one. On May 10, 2017 14:05, "Dave Page" wrote: > BTW; Ashesh, can you please ensure there's an RM ticket for this, as it's > obviously of interest to users. > > Thanks. > > On Wed, May 10, 2017 at 9:06 AM, Dave Page wrote: > >> >> >> On Wed, May 10, 2017 at 9:00 AM, Ashesh Vashi < >> ashesh.vashi@enterprisedb.com> wrote: >> >>> On Wed, May 10, 2017 at 1:29 PM, Dave Page wrote: >>> >>>> >>>> >>>> On Wed, May 10, 2017 at 8:56 AM, Ashesh Vashi < >>>> ashesh.vashi@enterprisedb.com> wrote: >>>> >>>>> Thanks. >>>>> Committed! >>>>> >>>> >>>> I agree with the change from a preventative/safety perspective, though >>>> I'm struggling to classify it as a security issue, given that collections >>>> are always named by the code and not from user input. >>>> >>>> Am I missing something? >>>> >>> True - but not the case with the server-group. >>> It is a collection node, still has it's own label. >>> >> >> Ahh, yes. >> >> -- >> Dave Page >> Blog: http://pgsnake.blogspot.com >> Twitter: @pgsnake >> >> EnterpriseDB UK: http://www.enterprisedb.com >> The Enterprise PostgreSQL Company >> > > > > -- > Dave Page > Blog: http://pgsnake.blogspot.com > Twitter: @pgsnake > > EnterpriseDB UK: http://www.enterprisedb.com > The Enterprise PostgreSQL Company > --001a11444bd49c912d054f2786e7 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Sure - I will create one.=C2=A0

On May 10, 2017 14:05, "Dave Pag= e" <dpage@pgadmin.org> = wrote:
BTW; Ashesh, can you please ensure there's an RM ticket for this, a= s it's obviously of interest to users.

Thanks.
=

On Wed, May= 10, 2017 at 9:06 AM, Dave Page <dpage@pgadmin.org> wrote:


On Wed, May 10, 2017 at 9:00 AM,= Ashesh Vashi <ashesh.vashi@enterprisedb.com> wrote:
On Wed, May 10, 2017 at 1:29 = PM, Dave Page <dpage@pgadmin.org> wrote:


On Wed, May 10, 2017 at 8:56 AM, Ashesh Vashi <ashesh.vashi@enterprisedb.com> wrote:
Thanks.
Committed!

I agree with the change from a preventative/s= afety perspective, though I'm struggling to classify it as a security i= ssue, given that collections are always named by the code and not from user= input.=C2=A0

Am I missing something?
True - but not the case with the ser= ver-group.
It is a collection node, still has it's own label.=

Ahh, yes.= =C2=A0

--
Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake

Enterpr= iseDB UK: http://= www.enterprisedb.com
The Enterprise PostgreSQL Company



--
Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake

Enterprise= DB UK: http://www= .enterprisedb.com
The Enterprise PostgreSQL Company
--001a11444bd49c912d054f2786e7--