From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Nicholas Chammas <nicholas.chammas@gmail.com>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: Amazon RDS auth tokens in .pgpass
Date: Mon, 31 Aug 2020 14:37:21 -0400
Message-ID: <4124291.1598899041@sss.pgh.pa.us> (raw)
In-Reply-To: <20200831182505.GU29590@tamriel.snowman.net>
References: <CAOhmDze1nqG2vfegpSsTFCgaiFRsqgjO6yLsbmhroz2zGmJHog@mail.gmail.com>
<4119486.1598897040@sss.pgh.pa.us>
<20200831181648.GT29590@tamriel.snowman.net>
<4123590.1598898063@sss.pgh.pa.us>
<20200831182505.GU29590@tamriel.snowman.net>
Stephen Frost <sfrost@snowman.net> writes:
> * Tom Lane (tgl@sss.pgh.pa.us) wrote:
>> That thread does point out that passwordFromFile() is far from the
>> only place that assumes passwords aren't going to be longer than
>> what would be sane to enter manually. I wonder whether we need to
>> worry about the other bottlenecks.
> Well, as I said in that thread two years ago, seems like we should make
> it work everywhere and be consistent between frontend and backend
> regarding what's supported. Perhaps even clearly document what the
> limit is too...
In the case of passwordFromFile(), the line doesn't only contain a
password. There's also a hostname that has no a-priori upper length,
and some other fields too; not to mention that if we have a convention
for comments then it's unfriendly to have an a-priori upper length for
comment lines. So I'm thinking that the correct thing to do in
passwordFromFile() is use an expansible buffer and fail only on OOM.
There remains, though, the question of whether any of the other limits
are problematic.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: tgl@sss.pgh.pa.us, sfrost@snowman.net, nicholas.chammas@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: Amazon RDS auth tokens in .pgpass
In-Reply-To: <4124291.1598899041@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox