agora inbox for pgpool-committers@postgresql.org
help / color / mirror / Atom feedFrom: Taiki Koshino <koshino@sraoss.co.jp>
To: pgpool-committers@lists.postgresql.org
Subject: pgpool: Delimit query-cache key to prevent collisions
Date: Wed, 16 Sep 2026 08:09:59 +0000
Message-ID: <E1x6kiM-0000000Cby0-2y7w@gothos.postgresql.org> (raw)
Delimit query-cache key to prevent collisions
I have reviewed the patch you provided.
It has also passed all regression tests.
encode_key() constructs the cache key using md5(user || query || database) without delimiters.
This allows different sessions to produce identical keys
(e.g., "admin" + "Q" + "testdb" and "adm" + "Q" + "intestdb"),
leading to data leakage between users/databases.
Changes:
Explicit Delimiters: Insert NUL bytes between the user, query, and database fields in the buffer.
Hash Full Range: Updated the hash function to process the entire byte range (including NUL separators)
instead of stopping at the first NUL byte.
Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com>
Reported-by: Claude code
Author: Taiki Koshino <koshino@sraoss.co.jp>
Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374DD1C2B89248B8714F84394C22%40TY4PR01MB17374.jpnpr...
Backpatch-through: v4.3
Branch
------
master
Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=f2e7f376493a501e0ac19f61517b926f7f9ea...
Modified Files
--------------
src/query_cache/pool_memqcache.c | 25 +++++++++++++++++++++----
1 file changed, 21 insertions(+), 4 deletions(-)
view thread (6+ messages) latest in thread
Message-ID: <E1x6kiM-0000000Cby0-2y7w@gothos.postgresql.org>
Permalink: ../E1x6kiM-0000000Cby0-2y7w@gothos.postgresql.org/
Also on: postgresql.org/message-id/E1x6kiM-0000000Cby0-2y7w@gothos.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgpool-committers@postgresql.org
Cc: koshino@sraoss.co.jp, pgpool-committers@lists.postgresql.org
Subject: Re: pgpool: Delimit query-cache key to prevent collisions
In-Reply-To: <E1x6kiM-0000000Cby0-2y7w@gothos.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox