agora inbox for pgpool-committers@postgresql.orghelp / color / mirror / Atom feed
pgpool: Delimit query-cache key to prevent collisions 6+ messages / 1 participants [nested] [flat]
* pgpool: Delimit query-cache key to prevent collisions @ 2026-09-16 08:09 Taiki Koshino <koshino@sraoss.co.jp> 0 siblings, 0 replies; 6+ messages in thread From: Taiki Koshino @ 2026-09-16 08:09 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Delimit query-cache key to prevent collisions I have reviewed the patch you provided. It has also passed all regression tests. encode_key() constructs the cache key using md5(user || query || database) without delimiters. This allows different sessions to produce identical keys (e.g., "admin" + "Q" + "testdb" and "adm" + "Q" + "intestdb"), leading to data leakage between users/databases. Changes: Explicit Delimiters: Insert NUL bytes between the user, query, and database fields in the buffer. Hash Full Range: Updated the hash function to process the entire byte range (including NUL separators) instead of stopping at the first NUL byte. Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com> Reported-by: Claude code Author: Taiki Koshino <koshino@sraoss.co.jp> Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374DD1C2B89248B8714F84394C22%40TY4PR01MB17374.jpnpr... Backpatch-through: v4.3 Branch ------ master Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=f2e7f376493a501e0ac19f61517b926f7f9ea... Modified Files -------------- src/query_cache/pool_memqcache.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Delimit query-cache key to prevent collisions @ 2026-09-16 08:10 Taiki Koshino <koshino@sraoss.co.jp> 0 siblings, 0 replies; 6+ messages in thread From: Taiki Koshino @ 2026-09-16 08:10 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Delimit query-cache key to prevent collisions I have reviewed the patch you provided. It has also passed all regression tests. encode_key() constructs the cache key using md5(user || query || database) without delimiters. This allows different sessions to produce identical keys (e.g., "admin" + "Q" + "testdb" and "adm" + "Q" + "intestdb"), leading to data leakage between users/databases. Changes: Explicit Delimiters: Insert NUL bytes between the user, query, and database fields in the buffer. Hash Full Range: Updated the hash function to process the entire byte range (including NUL separators) instead of stopping at the first NUL byte. Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com> Reported-by: Claude code Author: Taiki Koshino <koshino@sraoss.co.jp> Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374DD1C2B89248B8714F84394C22%40TY4PR01MB17374.jpnpr... Backpatch-through: v4.3 Branch ------ V4_7_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=f070a1181716f817099582201cdc0db18cb34... Modified Files -------------- src/query_cache/pool_memqcache.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Delimit query-cache key to prevent collisions @ 2026-09-16 08:22 Taiki Koshino <koshino@sraoss.co.jp> 0 siblings, 0 replies; 6+ messages in thread From: Taiki Koshino @ 2026-09-16 08:22 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Delimit query-cache key to prevent collisions I have reviewed the patch you provided. It has also passed all regression tests. encode_key() constructs the cache key using md5(user || query || database) without delimiters. This allows different sessions to produce identical keys (e.g., "admin" + "Q" + "testdb" and "adm" + "Q" + "intestdb"), leading to data leakage between users/databases. Changes: Explicit Delimiters: Insert NUL bytes between the user, query, and database fields in the buffer. Hash Full Range: Updated the hash function to process the entire byte range (including NUL separators) instead of stopping at the first NUL byte. Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com> Reported-by: Claude code Author: Taiki Koshino <koshino@sraoss.co.jp> Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374DD1C2B89248B8714F84394C22%40TY4PR01MB17374.jpnpr... Backpatch-through: v4.3 Branch ------ V4_6_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=96a891f08b8abc795f34c1540fef00374073f... Modified Files -------------- src/query_cache/pool_memqcache.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Delimit query-cache key to prevent collisions @ 2026-09-16 08:23 Taiki Koshino <koshino@sraoss.co.jp> 0 siblings, 0 replies; 6+ messages in thread From: Taiki Koshino @ 2026-09-16 08:23 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Delimit query-cache key to prevent collisions I have reviewed the patch you provided. It has also passed all regression tests. encode_key() constructs the cache key using md5(user || query || database) without delimiters. This allows different sessions to produce identical keys (e.g., "admin" + "Q" + "testdb" and "adm" + "Q" + "intestdb"), leading to data leakage between users/databases. Changes: Explicit Delimiters: Insert NUL bytes between the user, query, and database fields in the buffer. Hash Full Range: Updated the hash function to process the entire byte range (including NUL separators) instead of stopping at the first NUL byte. Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com> Reported-by: Claude code Author: Taiki Koshino <koshino@sraoss.co.jp> Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374DD1C2B89248B8714F84394C22%40TY4PR01MB17374.jpnpr... Backpatch-through: v4.3 Branch ------ V4_5_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=ce78e355fdbd9e395055a57cc563b98552beb... Modified Files -------------- src/query_cache/pool_memqcache.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Delimit query-cache key to prevent collisions @ 2026-09-16 08:23 Taiki Koshino <koshino@sraoss.co.jp> 0 siblings, 0 replies; 6+ messages in thread From: Taiki Koshino @ 2026-09-16 08:23 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Delimit query-cache key to prevent collisions I have reviewed the patch you provided. It has also passed all regression tests. encode_key() constructs the cache key using md5(user || query || database) without delimiters. This allows different sessions to produce identical keys (e.g., "admin" + "Q" + "testdb" and "adm" + "Q" + "intestdb"), leading to data leakage between users/databases. Changes: Explicit Delimiters: Insert NUL bytes between the user, query, and database fields in the buffer. Hash Full Range: Updated the hash function to process the entire byte range (including NUL separators) instead of stopping at the first NUL byte. Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com> Reported-by: Claude code Author: Taiki Koshino <koshino@sraoss.co.jp> Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374DD1C2B89248B8714F84394C22%40TY4PR01MB17374.jpnpr... Backpatch-through: v4.3 Branch ------ V4_4_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=ed0ce534257c28f99b19067579f5ad9ced0ad... Modified Files -------------- src/query_cache/pool_memqcache.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Delimit query-cache key to prevent collisions @ 2026-09-16 08:24 Taiki Koshino <koshino@sraoss.co.jp> 0 siblings, 0 replies; 6+ messages in thread From: Taiki Koshino @ 2026-09-16 08:24 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Delimit query-cache key to prevent collisions I have reviewed the patch you provided. It has also passed all regression tests. encode_key() constructs the cache key using md5(user || query || database) without delimiters. This allows different sessions to produce identical keys (e.g., "admin" + "Q" + "testdb" and "adm" + "Q" + "intestdb"), leading to data leakage between users/databases. Changes: Explicit Delimiters: Insert NUL bytes between the user, query, and database fields in the buffer. Hash Full Range: Updated the hash function to process the entire byte range (including NUL separators) instead of stopping at the first NUL byte. Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com> Reported-by: Claude code Author: Taiki Koshino <koshino@sraoss.co.jp> Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374DD1C2B89248B8714F84394C22%40TY4PR01MB17374.jpnpr... Backpatch-through: v4.3 Branch ------ V4_3_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=13f8d0d13e32d3053bac21f29e484b9547a2b... Modified Files -------------- src/query_cache/pool_memqcache.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2026-09-16 08:24 UTC | newest] Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-09-16 08:09 pgpool: Delimit query-cache key to prevent collisions Taiki Koshino <koshino@sraoss.co.jp> 2026-09-16 08:10 pgpool: Delimit query-cache key to prevent collisions Taiki Koshino <koshino@sraoss.co.jp> 2026-09-16 08:22 pgpool: Delimit query-cache key to prevent collisions Taiki Koshino <koshino@sraoss.co.jp> 2026-09-16 08:23 pgpool: Delimit query-cache key to prevent collisions Taiki Koshino <koshino@sraoss.co.jp> 2026-09-16 08:23 pgpool: Delimit query-cache key to prevent collisions Taiki Koshino <koshino@sraoss.co.jp> 2026-09-16 08:24 pgpool: Delimit query-cache key to prevent collisions Taiki Koshino <koshino@sraoss.co.jp>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox