Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <pgsql-committers-owner+archive@lists.postgresql.org>)
	id 1wuX7q-000ldg-2F
	for pgsql-committers@arkaria.postgresql.org;
	Thu, 13 Aug 2026 15:13:46 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.96)
	(envelope-from <pgsql-committers-owner+archive@lists.postgresql.org>)
	id 1wuX7k-00E4aK-2k
	for pgsql-committers@arkaria.postgresql.org;
	Thu, 13 Aug 2026 15:13:41 +0000
Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29])
	by malur.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <noah@leadboat.com>)
	id 1wtQG9-00HQse-1G
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:41:44 +0000
Received: from mahout.postgresql.org ([2001:4800:3e1:1::227])
	by magus.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.98.2)
	(envelope-from <noah@leadboat.com>)
	id 1wtQFt-00000001M41-0Yad
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:41:44 +0000
Received: from gemulon.postgresql.org ([2001:4800:3e1:1::198])
	by mahout.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <noah@leadboat.com>)
	id 1wtQFq-00218V-1R
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:41:26 +0000
Received: from localhost ([127.0.0.1] helo=gemulon.postgresql.org)
	by gemulon.postgresql.org with esmtp (Exim 4.98.2)
	(envelope-from <noah@leadboat.com>)
	id 1wtQFo-00000000y9F-3aqB
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:41:24 +0000
Content-Type: multipart/mixed; boundary="===============6122793346693722700=="
MIME-Version: 1.0
From: Noah Misch <noah@leadboat.com>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Obstruct EXTRACT() field name deparse injection.
X-Auto-Response-Suppress: All
Auto-Submitted: auto-generated
Message-Id: <E1wtQFo-00000000y9F-3aqB@gemulon.postgresql.org>
Date: Mon, 10 Aug 2026 13:41:24 +0000
List-Id: <pgsql-committers.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-committers@lists.postgresql.org>
List-Owner: <mailto:pgsql-committers-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-committers>
Archived-At: 
 <https://www.postgresql.org/message-id/E1wtQFo-00000000y9F-3aqB%40gemulon.postgresql.org>
Precedence: bulk

--===============6122793346693722700==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64

T2JzdHJ1Y3QgRVhUUkFDVCgpIGZpZWxkIG5hbWUgZGVwYXJzZSBpbmplY3Rpb24uCgpUaGUgcGFy
c2VyIGFjY2VwdHMgYW55IHN0cmluZyBhcyBhbiBFWFRSQUNUKCkgZmllbGQgbmFtZSwgYnV0CmRl
cGFyc2luZyBkb2VzIG5vdCBxdW90ZSBhbmQgZXNjYXBlIGl0IGFjY29yZGluZ2x5LiAgVG8gZml4
LCBxdW90ZQphbmQgZXNjYXBlIHRoZSBmaWVsZCBuYW1lIGR1cmluZyBkZXBhcnNpbmcgYXMgbmVl
ZGVkLiAgSXQgbWlnaHQgYmUKYSBnb29kIGlkZWEgdG8gdmFsaWRhdGUgdGhlIGZpZWxkIG5hbWUg
ZHVyaW5nIHBhcnNpbmcgYW5kCmRlcGFyc2luZywgdG9vLCBidXQgdGhhdCBpcyBsZWZ0IGFzIGEg
ZnV0dXJlIGV4ZXJjaXNlLgoKUmVwb3J0ZWQtYnk6IEJlbiBNb3JyaXMgaW4gY29sbGFib3JhdGlv
biB3aXRoIENsYXVkZSBhbmQgQW50aHJvcGljIFJlc2VhcmNoCkF1dGhvcjogTmF0aGFuIEJvc3Nh
cnQgPG5hdGhhbmRib3NzYXJ0QGdtYWlsLmNvbT4KUmV2aWV3ZWQtYnk6IFRvbSBMYW5lIDx0Z2xA
c3NzLnBnaC5wYS51cz4KUmV2aWV3ZWQtYnk6IEV0c3VybyBGdWppdGEgPGV0c3Vyby5mdWppdGFA
Z21haWwuY29tPgpTZWN1cml0eTogQ1ZFLTIwMjYtMTU3NDEKQmFja3BhdGNoLXRocm91Z2g6IDE0
CgpCcmFuY2gKLS0tLS0tClJFTF8xOF9TVEFCTEUKCkRldGFpbHMKLS0tLS0tLQpodHRwczovL2dp
dC5wb3N0Z3Jlc3FsLm9yZy9wZy9jb21taXRkaWZmLzBkZGQ5MDk4YTMxMGVkNzExYzZjYmE3NThj
MDZkZmUzOGY5NjU0ZmYKQXV0aG9yOiBOYXRoYW4gQm9zc2FydCA8bmF0aGFuQHBvc3RncmVzcWwu
b3JnPgoKTW9kaWZpZWQgRmlsZXMKLS0tLS0tLS0tLS0tLS0Kc3JjL2JhY2tlbmQvdXRpbHMvYWR0
L3J1bGV1dGlscy5jIHwgMyArKy0KMSBmaWxlIGNoYW5nZWQsIDIgaW5zZXJ0aW9ucygrKSwgMSBk
ZWxldGlvbigtKQoK

--===============6122793346693722700==--