Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <pgsql-committers-owner+archive@lists.postgresql.org>)
	id 1wuX7o-000ldh-1q
	for pgsql-committers@arkaria.postgresql.org;
	Thu, 13 Aug 2026 15:13:44 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.96)
	(envelope-from <pgsql-committers-owner+archive@lists.postgresql.org>)
	id 1wuX7k-00E4aT-2s
	for pgsql-committers@arkaria.postgresql.org;
	Thu, 13 Aug 2026 15:13:42 +0000
Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29])
	by malur.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <noah@leadboat.com>)
	id 1wtQGG-00HQwY-0Z
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:41:51 +0000
Received: from mahout.postgresql.org ([72.32.157.227])
	by magus.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.98.2)
	(envelope-from <noah@leadboat.com>)
	id 1wtQFv-00000001M4n-2L8N
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:41:51 +0000
Received: from gemulon.postgresql.org ([72.32.157.198])
	by mahout.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <noah@leadboat.com>)
	id 1wtQFs-00219h-1u
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:41:28 +0000
Received: from localhost ([127.0.0.1] helo=gemulon.postgresql.org)
	by gemulon.postgresql.org with esmtp (Exim 4.98.2)
	(envelope-from <noah@leadboat.com>)
	id 1wtQFr-00000000yCw-2fMK
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:41:27 +0000
Content-Type: multipart/mixed; boundary="===============9198041491272312957=="
MIME-Version: 1.0
From: Noah Misch <noah@leadboat.com>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Obstruct EXTRACT() field name deparse injection.
X-Auto-Response-Suppress: All
Auto-Submitted: auto-generated
Message-Id: <E1wtQFr-00000000yCw-2fMK@gemulon.postgresql.org>
Date: Mon, 10 Aug 2026 13:41:27 +0000
List-Id: <pgsql-committers.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-committers@lists.postgresql.org>
List-Owner: <mailto:pgsql-committers-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-committers>
Archived-At: 
 <https://www.postgresql.org/message-id/E1wtQFr-00000000yCw-2fMK%40gemulon.postgresql.org>
Precedence: bulk

--===============9198041491272312957==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64

T2JzdHJ1Y3QgRVhUUkFDVCgpIGZpZWxkIG5hbWUgZGVwYXJzZSBpbmplY3Rpb24uCgpUaGUgcGFy
c2VyIGFjY2VwdHMgYW55IHN0cmluZyBhcyBhbiBFWFRSQUNUKCkgZmllbGQgbmFtZSwgYnV0CmRl
cGFyc2luZyBkb2VzIG5vdCBxdW90ZSBhbmQgZXNjYXBlIGl0IGFjY29yZGluZ2x5LiAgVG8gZml4
LCBxdW90ZQphbmQgZXNjYXBlIHRoZSBmaWVsZCBuYW1lIGR1cmluZyBkZXBhcnNpbmcgYXMgbmVl
ZGVkLiAgSXQgbWlnaHQgYmUKYSBnb29kIGlkZWEgdG8gdmFsaWRhdGUgdGhlIGZpZWxkIG5hbWUg
ZHVyaW5nIHBhcnNpbmcgYW5kCmRlcGFyc2luZywgdG9vLCBidXQgdGhhdCBpcyBsZWZ0IGFzIGEg
ZnV0dXJlIGV4ZXJjaXNlLgoKUmVwb3J0ZWQtYnk6IEJlbiBNb3JyaXMgaW4gY29sbGFib3JhdGlv
biB3aXRoIENsYXVkZSBhbmQgQW50aHJvcGljIFJlc2VhcmNoCkF1dGhvcjogTmF0aGFuIEJvc3Nh
cnQgPG5hdGhhbmRib3NzYXJ0QGdtYWlsLmNvbT4KUmV2aWV3ZWQtYnk6IFRvbSBMYW5lIDx0Z2xA
c3NzLnBnaC5wYS51cz4KUmV2aWV3ZWQtYnk6IEV0c3VybyBGdWppdGEgPGV0c3Vyby5mdWppdGFA
Z21haWwuY29tPgpTZWN1cml0eTogQ1ZFLTIwMjYtMTU3NDEKQmFja3BhdGNoLXRocm91Z2g6IDE0
CgpCcmFuY2gKLS0tLS0tClJFTF8xN19TVEFCTEUKCkRldGFpbHMKLS0tLS0tLQpodHRwczovL2dp
dC5wb3N0Z3Jlc3FsLm9yZy9wZy9jb21taXRkaWZmLzU5ODFmZTM3MGEwZDQzMzQyOTk3N2ZmNmZj
NDIwMDY0Y2YyZmEwOWEKQXV0aG9yOiBOYXRoYW4gQm9zc2FydCA8bmF0aGFuQHBvc3RncmVzcWwu
b3JnPgoKTW9kaWZpZWQgRmlsZXMKLS0tLS0tLS0tLS0tLS0Kc3JjL2JhY2tlbmQvdXRpbHMvYWR0
L3J1bGV1dGlscy5jIHwgMyArKy0KMSBmaWxlIGNoYW5nZWQsIDIgaW5zZXJ0aW9ucygrKSwgMSBk
ZWxldGlvbigtKQoK

--===============9198041491272312957==--