Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <pgsql-committers-owner+archive@lists.postgresql.org>)
	id 1wuX53-000lYh-1R
	for pgsql-committers@arkaria.postgresql.org;
	Thu, 13 Aug 2026 15:10:53 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.96)
	(envelope-from <pgsql-committers-owner+archive@lists.postgresql.org>)
	id 1wuX51-00DYpS-0v
	for pgsql-committers@arkaria.postgresql.org;
	Thu, 13 Aug 2026 15:10:52 +0000
Received: from makus.postgresql.org ([2001:4800:3e1:1::229])
	by malur.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <noah@leadboat.com>)
	id 1wtQFu-00HQjC-2S
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:41:30 +0000
Received: from mahout.postgresql.org ([2001:4800:3e1:1::227])
	by makus.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.98.2)
	(envelope-from <noah@leadboat.com>)
	id 1wtQFm-00000001BzQ-0iKl
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:41:29 +0000
Received: from gemulon.postgresql.org ([2001:4800:3e1:1::198])
	by mahout.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <noah@leadboat.com>)
	id 1wtQFl-00216e-0z
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:41:21 +0000
Received: from localhost ([127.0.0.1] helo=gemulon.postgresql.org)
	by gemulon.postgresql.org with esmtp (Exim 4.98.2)
	(envelope-from <noah@leadboat.com>)
	id 1wtQFk-00000000y1U-2IWV
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:41:20 +0000
Content-Type: multipart/mixed; boundary="===============0310934804762727809=="
MIME-Version: 1.0
From: Noah Misch <noah@leadboat.com>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Obstruct EXTRACT() field name deparse injection.
X-Auto-Response-Suppress: All
Auto-Submitted: auto-generated
Message-Id: <E1wtQFk-00000000y1U-2IWV@gemulon.postgresql.org>
Date: Mon, 10 Aug 2026 13:41:20 +0000
List-Id: <pgsql-committers.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-committers@lists.postgresql.org>
List-Owner: <mailto:pgsql-committers-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-committers>
Archived-At: 
 <https://www.postgresql.org/message-id/E1wtQFk-00000000y1U-2IWV%40gemulon.postgresql.org>
Precedence: bulk

--===============0310934804762727809==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64

T2JzdHJ1Y3QgRVhUUkFDVCgpIGZpZWxkIG5hbWUgZGVwYXJzZSBpbmplY3Rpb24uCgpUaGUgcGFy
c2VyIGFjY2VwdHMgYW55IHN0cmluZyBhcyBhbiBFWFRSQUNUKCkgZmllbGQgbmFtZSwgYnV0CmRl
cGFyc2luZyBkb2VzIG5vdCBxdW90ZSBhbmQgZXNjYXBlIGl0IGFjY29yZGluZ2x5LiAgVG8gZml4
LCBxdW90ZQphbmQgZXNjYXBlIHRoZSBmaWVsZCBuYW1lIGR1cmluZyBkZXBhcnNpbmcgYXMgbmVl
ZGVkLiAgSXQgbWlnaHQgYmUKYSBnb29kIGlkZWEgdG8gdmFsaWRhdGUgdGhlIGZpZWxkIG5hbWUg
ZHVyaW5nIHBhcnNpbmcgYW5kCmRlcGFyc2luZywgdG9vLCBidXQgdGhhdCBpcyBsZWZ0IGFzIGEg
ZnV0dXJlIGV4ZXJjaXNlLgoKUmVwb3J0ZWQtYnk6IEJlbiBNb3JyaXMgaW4gY29sbGFib3JhdGlv
biB3aXRoIENsYXVkZSBhbmQgQW50aHJvcGljIFJlc2VhcmNoCkF1dGhvcjogTmF0aGFuIEJvc3Nh
cnQgPG5hdGhhbmRib3NzYXJ0QGdtYWlsLmNvbT4KUmV2aWV3ZWQtYnk6IFRvbSBMYW5lIDx0Z2xA
c3NzLnBnaC5wYS51cz4KUmV2aWV3ZWQtYnk6IEV0c3VybyBGdWppdGEgPGV0c3Vyby5mdWppdGFA
Z21haWwuY29tPgpTZWN1cml0eTogQ1ZFLTIwMjYtMTU3NDEKQmFja3BhdGNoLXRocm91Z2g6IDE0
CgpCcmFuY2gKLS0tLS0tCm1hc3RlcgoKRGV0YWlscwotLS0tLS0tCmh0dHBzOi8vZ2l0LnBvc3Rn
cmVzcWwub3JnL3BnL2NvbW1pdGRpZmYvZjk3MjliNTA3OGRjYTA4ZjVjODczY2EwNjNmMDQ0OWU4
YmIzZjI1NgpBdXRob3I6IE5hdGhhbiBCb3NzYXJ0IDxuYXRoYW5AcG9zdGdyZXNxbC5vcmc+CgpN
b2RpZmllZCBGaWxlcwotLS0tLS0tLS0tLS0tLQpzcmMvYmFja2VuZC91dGlscy9hZHQvcnVsZXV0
aWxzLmMgfCAzICsrLQoxIGZpbGUgY2hhbmdlZCwgMiBpbnNlcnRpb25zKCspLCAxIGRlbGV0aW9u
KC0pCgo=

--===============0310934804762727809==--