Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <pgsql-committers-owner+archive@lists.postgresql.org>)
	id 1wuXHw-000m1Z-0N
	for pgsql-committers@arkaria.postgresql.org;
	Thu, 13 Aug 2026 15:24:12 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.96)
	(envelope-from <pgsql-committers-owner+archive@lists.postgresql.org>)
	id 1wuXHs-00En1t-1x
	for pgsql-committers@arkaria.postgresql.org;
	Thu, 13 Aug 2026 15:24:09 +0000
Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29])
	by malur.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <noah@leadboat.com>)
	id 1wtQGb-00HRB5-04
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:42:12 +0000
Received: from mahout.postgresql.org ([72.32.157.227])
	by magus.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.98.2)
	(envelope-from <noah@leadboat.com>)
	id 1wtQGX-00000001M5D-2lnK
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:42:12 +0000
Received: from gemulon.postgresql.org ([72.32.157.198])
	by mahout.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <noah@leadboat.com>)
	id 1wtQFv-0021BD-30
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:41:31 +0000
Received: from localhost ([127.0.0.1] helo=gemulon.postgresql.org)
	by gemulon.postgresql.org with esmtp (Exim 4.98.2)
	(envelope-from <noah@leadboat.com>)
	id 1wtQFv-00000000yKz-1CML
	for pgsql-committers@lists.postgresql.org;
	Mon, 10 Aug 2026 13:41:31 +0000
Content-Type: multipart/mixed; boundary="===============6570988758502002218=="
MIME-Version: 1.0
From: Noah Misch <noah@leadboat.com>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Obstruct EXTRACT() field name deparse injection.
X-Auto-Response-Suppress: All
Auto-Submitted: auto-generated
Message-Id: <E1wtQFv-00000000yKz-1CML@gemulon.postgresql.org>
Date: Mon, 10 Aug 2026 13:41:31 +0000
List-Id: <pgsql-committers.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-committers@lists.postgresql.org>
List-Owner: <mailto:pgsql-committers-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-committers>
Archived-At: 
 <https://www.postgresql.org/message-id/E1wtQFv-00000000yKz-1CML%40gemulon.postgresql.org>
Precedence: bulk

--===============6570988758502002218==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64

T2JzdHJ1Y3QgRVhUUkFDVCgpIGZpZWxkIG5hbWUgZGVwYXJzZSBpbmplY3Rpb24uCgpUaGUgcGFy
c2VyIGFjY2VwdHMgYW55IHN0cmluZyBhcyBhbiBFWFRSQUNUKCkgZmllbGQgbmFtZSwgYnV0CmRl
cGFyc2luZyBkb2VzIG5vdCBxdW90ZSBhbmQgZXNjYXBlIGl0IGFjY29yZGluZ2x5LiAgVG8gZml4
LCBxdW90ZQphbmQgZXNjYXBlIHRoZSBmaWVsZCBuYW1lIGR1cmluZyBkZXBhcnNpbmcgYXMgbmVl
ZGVkLiAgSXQgbWlnaHQgYmUKYSBnb29kIGlkZWEgdG8gdmFsaWRhdGUgdGhlIGZpZWxkIG5hbWUg
ZHVyaW5nIHBhcnNpbmcgYW5kCmRlcGFyc2luZywgdG9vLCBidXQgdGhhdCBpcyBsZWZ0IGFzIGEg
ZnV0dXJlIGV4ZXJjaXNlLgoKUmVwb3J0ZWQtYnk6IEJlbiBNb3JyaXMgaW4gY29sbGFib3JhdGlv
biB3aXRoIENsYXVkZSBhbmQgQW50aHJvcGljIFJlc2VhcmNoCkF1dGhvcjogTmF0aGFuIEJvc3Nh
cnQgPG5hdGhhbmRib3NzYXJ0QGdtYWlsLmNvbT4KUmV2aWV3ZWQtYnk6IFRvbSBMYW5lIDx0Z2xA
c3NzLnBnaC5wYS51cz4KUmV2aWV3ZWQtYnk6IEV0c3VybyBGdWppdGEgPGV0c3Vyby5mdWppdGFA
Z21haWwuY29tPgpTZWN1cml0eTogQ1ZFLTIwMjYtMTU3NDEKQmFja3BhdGNoLXRocm91Z2g6IDE0
CgpCcmFuY2gKLS0tLS0tClJFTF8xNV9TVEFCTEUKCkRldGFpbHMKLS0tLS0tLQpodHRwczovL2dp
dC5wb3N0Z3Jlc3FsLm9yZy9wZy9jb21taXRkaWZmLzQ0ZWE2NzY0YmU3NmViYjNkOGRkMDFkNjBi
NTc1MWFjYmU3Yjg3ZDMKQXV0aG9yOiBOYXRoYW4gQm9zc2FydCA8bmF0aGFuQHBvc3RncmVzcWwu
b3JnPgoKTW9kaWZpZWQgRmlsZXMKLS0tLS0tLS0tLS0tLS0Kc3JjL2JhY2tlbmQvdXRpbHMvYWR0
L3J1bGV1dGlscy5jIHwgMyArKy0KMSBmaWxlIGNoYW5nZWQsIDIgaW5zZXJ0aW9ucygrKSwgMSBk
ZWxldGlvbigtKQoK

--===============6570988758502002218==--