Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <pgsql-committers-owner+archive@lists.postgresql.org>)
	id 1wuX7p-000ldg-2O
	for pgsql-committers@arkaria.postgresql.org;
	Thu, 13 Aug 2026 15:13:45 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.96)
	(envelope-from <pgsql-committers-owner+archive@lists.postgresql.org>)
	id 1wuX7k-00E4aS-2k
	for pgsql-committers@arkaria.postgresql.org;
	Thu, 13 Aug 2026 15:13:41 +0000
Received: from makus.postgresql.org ([2001:4800:3e1:1::229])
	by malur.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <noah@leadboat.com>)
	id 1wtQGA-00HQsu-0j
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:41:45 +0000
Received: from mahout.postgresql.org ([2001:4800:3e1:1::227])
	by makus.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.98.2)
	(envelope-from <noah@leadboat.com>)
	id 1wtQFp-00000001Bzv-3wuC
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:41:44 +0000
Received: from gemulon.postgresql.org ([2001:4800:3e1:1::198])
	by mahout.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <noah@leadboat.com>)
	id 1wtQFn-00217T-29
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:41:23 +0000
Received: from localhost ([127.0.0.1] helo=gemulon.postgresql.org)
	by gemulon.postgresql.org with esmtp (Exim 4.98.2)
	(envelope-from <noah@leadboat.com>)
	id 1wtQFm-00000000y4z-2qoQ
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:41:22 +0000
Content-Type: multipart/mixed; boundary="===============0120634498322262784=="
MIME-Version: 1.0
From: Noah Misch <noah@leadboat.com>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Obstruct EXTRACT() field name deparse injection.
X-Auto-Response-Suppress: All
Auto-Submitted: auto-generated
Message-Id: <E1wtQFm-00000000y4z-2qoQ@gemulon.postgresql.org>
Date: Mon, 10 Aug 2026 13:41:22 +0000
List-Id: <pgsql-committers.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-committers@lists.postgresql.org>
List-Owner: <mailto:pgsql-committers-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-committers>
Archived-At: 
 <https://www.postgresql.org/message-id/E1wtQFm-00000000y4z-2qoQ%40gemulon.postgresql.org>
Precedence: bulk

--===============0120634498322262784==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64

T2JzdHJ1Y3QgRVhUUkFDVCgpIGZpZWxkIG5hbWUgZGVwYXJzZSBpbmplY3Rpb24uCgpUaGUgcGFy
c2VyIGFjY2VwdHMgYW55IHN0cmluZyBhcyBhbiBFWFRSQUNUKCkgZmllbGQgbmFtZSwgYnV0CmRl
cGFyc2luZyBkb2VzIG5vdCBxdW90ZSBhbmQgZXNjYXBlIGl0IGFjY29yZGluZ2x5LiAgVG8gZml4
LCBxdW90ZQphbmQgZXNjYXBlIHRoZSBmaWVsZCBuYW1lIGR1cmluZyBkZXBhcnNpbmcgYXMgbmVl
ZGVkLiAgSXQgbWlnaHQgYmUKYSBnb29kIGlkZWEgdG8gdmFsaWRhdGUgdGhlIGZpZWxkIG5hbWUg
ZHVyaW5nIHBhcnNpbmcgYW5kCmRlcGFyc2luZywgdG9vLCBidXQgdGhhdCBpcyBsZWZ0IGFzIGEg
ZnV0dXJlIGV4ZXJjaXNlLgoKUmVwb3J0ZWQtYnk6IEJlbiBNb3JyaXMgaW4gY29sbGFib3JhdGlv
biB3aXRoIENsYXVkZSBhbmQgQW50aHJvcGljIFJlc2VhcmNoCkF1dGhvcjogTmF0aGFuIEJvc3Nh
cnQgPG5hdGhhbmRib3NzYXJ0QGdtYWlsLmNvbT4KUmV2aWV3ZWQtYnk6IFRvbSBMYW5lIDx0Z2xA
c3NzLnBnaC5wYS51cz4KUmV2aWV3ZWQtYnk6IEV0c3VybyBGdWppdGEgPGV0c3Vyby5mdWppdGFA
Z21haWwuY29tPgpTZWN1cml0eTogQ1ZFLTIwMjYtMTU3NDEKQmFja3BhdGNoLXRocm91Z2g6IDE0
CgpCcmFuY2gKLS0tLS0tClJFTF8xOV9TVEFCTEUKCkRldGFpbHMKLS0tLS0tLQpodHRwczovL2dp
dC5wb3N0Z3Jlc3FsLm9yZy9wZy9jb21taXRkaWZmL2EzODMyYTc1NzEwMTM0NjlkYzgxZTM1ZDBm
ZTFjMDA2NmU4NmQ4OTMKQXV0aG9yOiBOYXRoYW4gQm9zc2FydCA8bmF0aGFuQHBvc3RncmVzcWwu
b3JnPgoKTW9kaWZpZWQgRmlsZXMKLS0tLS0tLS0tLS0tLS0Kc3JjL2JhY2tlbmQvdXRpbHMvYWR0
L3J1bGV1dGlscy5jIHwgMyArKy0KMSBmaWxlIGNoYW5nZWQsIDIgaW5zZXJ0aW9ucygrKSwgMSBk
ZWxldGlvbigtKQoK

--===============0120634498322262784==--