MIME-Version: 1.0
In-Reply-To: 
 <CA+OCxoxHMMzgFCQ8hmMx9AtoYcRpVO2KJqLKJNWMf9=KYEJ7qw@mail.gmail.com>
References: <b6c79719012594bfe674b809337298b1@imp-m.ru>
 <CAG7mmoygGeXaeV9WT3cBtLKf_4qsdFBvivUZyp1pbkxmh3mUkw@mail.gmail.com>
 <CA+OCxoxHMMzgFCQ8hmMx9AtoYcRpVO2KJqLKJNWMf9=KYEJ7qw@mail.gmail.com>
From: Ashesh Vashi <ashesh.vashi@enterprisedb.com>
Date: Wed, 10 May 2017 13:30:57 +0530
Message-ID: 
 <CAG7mmoz8HSMBZcA+mpY_dzkJP6MZbWf44EHh3OBGutRzQDCDXQ@mail.gmail.com>
Subject: Re: security bug (with patch-fix) -- need more
 HTML-escaping for working with tree-nodes
To: Dave Page <dpage@pgadmin.org>
Cc: Andrei Antonov <antonov@imp-m.ru>,
 pgadmin-hackers <pgadmin-hackers@postgresql.org>
Content-Type: multipart/alternative; boundary=001a11444bd48d28af054f26e0b0
Precedence: bulk
Sender: pgadmin-hackers-owner@postgresql.org

--001a11444bd48d28af054f26e0b0
Content-Type: text/plain; charset=UTF-8

On Wed, May 10, 2017 at 1:29 PM, Dave Page <dpage@pgadmin.org> wrote:

>
>
> On Wed, May 10, 2017 at 8:56 AM, Ashesh Vashi <
> ashesh.vashi@enterprisedb.com> wrote:
>
>> Thanks.
>> Committed!
>>
>
> I agree with the change from a preventative/safety perspective, though I'm
> struggling to classify it as a security issue, given that collections are
> always named by the code and not from user input.
>
> Am I missing something?
>
True - but not the case with the server-group.
It is a collection node, still has it's own label.

-- Thanks, Ashesh

>
> --
> Dave Page
> Blog: http://pgsnake.blogspot.com
> Twitter: @pgsnake
>
> EnterpriseDB UK: http://www.enterprisedb.com
> The Enterprise PostgreSQL Company
>

--001a11444bd48d28af054f26e0b0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On W=
ed, May 10, 2017 at 1:29 PM, Dave Page <span dir=3D"ltr">&lt;<a href=3D"mai=
lto:dpage@pgadmin.org" target=3D"_blank">dpage@pgadmin.org</a>&gt;</span> w=
rote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;borde=
r-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><br><div class=3D"=
gmail_extra"><br><div class=3D"gmail_quote">On Wed, May 10, 2017 at 8:56 AM=
, Ashesh Vashi <span dir=3D"ltr">&lt;<a href=3D"mailto:ashesh.vashi@enterpr=
isedb.com" target=3D"_blank">ashesh.vashi@enterprisedb.com</a><wbr>&gt;</sp=
an> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;=
border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr">Thanks.<div>C=
ommitted!</div></div></blockquote><div><br></div><div>I agree with the chan=
ge from a preventative/safety perspective, though I&#39;m struggling to cla=
ssify it as a security issue, given that collections are always named by th=
e code and not from user input.=C2=A0</div></div><br clear=3D"all"><div>Am =
I missing something?</div></div></div></blockquote><div>True - but not the =
case with the server-group.</div><div>It is a collection node, still has it=
&#39;s own label.</div><div><br></div><div>-- Thanks, Ashesh=C2=A0</div><bl=
ockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #=
ccc solid;padding-left:1ex"><div dir=3D"ltr"><div class=3D"gmail_extra"><sp=
an class=3D"HOEnZb"><font color=3D"#888888"><div><br></div>-- <br><div clas=
s=3D"m_-4259583465247071246gmail_signature" data-smartmail=3D"gmail_signatu=
re">Dave Page<br>Blog: <a href=3D"http://pgsnake.blogspot.com" target=3D"_b=
lank">http://pgsnake.blogspot.com</a><br>Twitter: @pgsnake<br><br>Enterpris=
eDB UK: <a href=3D"http://www.enterprisedb.com" target=3D"_blank">http://ww=
w.enterprisedb.com</a><br>The Enterprise PostgreSQL Company<br></div>
</font></span></div></div>
</blockquote></div><br></div></div>

--001a11444bd48d28af054f26e0b0--