pg.ddx.io pgsql-docs@postgresql.org mailing list archive
help / color / mirror / Atom feedPotential vuln in example for "F.25.1.1. digest()"
3+ messages / 3 participants
[nested] [flat]
* Potential vuln in example for "F.25.1.1. digest()"
@ 2021-08-17 16:11 PG Doc comments form <noreply@postgresql.org>
2021-08-17 18:06 ` Re: Potential vuln in example for "F.25.1.1. digest()" David G. Johnston <david.g.johnston@gmail.com>
0 siblings, 1 reply; 3+ messages in thread
From: PG Doc comments form @ 2021-08-17 16:11 UTC (permalink / raw)
To: pgsql-docs@lists.postgresql.org; +Cc: cc@sse-ag.ch
The following documentation comment has been logged on the website:
Page: https://www.postgresql.org/docs/13/pgcrypto.html
Description:
Hi,
in "F.25.1.1. digest()" you suggest:
CREATE OR REPLACE FUNCTION sha1(bytea) returns text AS $$
SELECT encode(digest($1, 'sha1'), 'hex')
$$ LANGUAGE SQL STRICT IMMUTABLE;
While this is a great example, it may expose a database app to
vulnerabilities if the attacker succeeds in overriding the function
sha1(...) in the app's user context (schema). This may or may not require
administrative privileges.
Explicitly putting it into the "postgres" schema and calling it using
"postgres.sha1(...)" could mitigate the risk in such a way that
administrative privileges are required.
Do you have an even better solution to secure it?
:-) Beat
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: Potential vuln in example for "F.25.1.1. digest()"
2021-08-17 16:11 Potential vuln in example for "F.25.1.1. digest()" PG Doc comments form <noreply@postgresql.org>
@ 2021-08-17 18:06 ` David G. Johnston <david.g.johnston@gmail.com>
2021-08-17 18:33 ` Re: Potential vuln in example for "F.25.1.1. digest()" Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 3+ messages in thread
From: David G. Johnston @ 2021-08-17 18:06 UTC (permalink / raw)
To: cc@sse-ag.ch <cc@sse-ag.ch>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>
On Tuesday, August 17, 2021, PG Doc comments form <noreply@postgresql.org>
wrote:
> The following documentation comment has been logged on the website:
>
> Page: https://www.postgresql.org/docs/13/pgcrypto.html
> Description:
>
> Hi,
> in "F.25.1.1. digest()" you suggest:
>
> CREATE OR REPLACE FUNCTION sha1(bytea) returns text AS $$
> SELECT encode(digest($1, 'sha1'), 'hex')
> $$ LANGUAGE SQL STRICT IMMUTABLE;
>
> While this is a great example, it may expose a database app to
> vulnerabilities if the attacker succeeds in overriding the function
> sha1(...) in the app's user context (schema)
>
You should read this:
https://wiki.postgresql.org/wiki/A_Guide_to_CVE-2018-1058%3A_Protect_Your_Search_Path
David J.
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: Potential vuln in example for "F.25.1.1. digest()"
2021-08-17 16:11 Potential vuln in example for "F.25.1.1. digest()" PG Doc comments form <noreply@postgresql.org>
2021-08-17 18:06 ` Re: Potential vuln in example for "F.25.1.1. digest()" David G. Johnston <david.g.johnston@gmail.com>
@ 2021-08-17 18:33 ` Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 3+ messages in thread
From: Tom Lane @ 2021-08-17 18:33 UTC (permalink / raw)
To: David G. Johnston <david.g.johnston@gmail.com>; +Cc: cc@sse-ag.ch <cc@sse-ag.ch>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>
"David G. Johnston" <david.g.johnston@gmail.com> writes:
> On Tuesday, August 17, 2021, PG Doc comments form <noreply@postgresql.org>
> wrote:
>> in "F.25.1.1. digest()" you suggest:
>>
>> CREATE OR REPLACE FUNCTION sha1(bytea) returns text AS $$
>> SELECT encode(digest($1, 'sha1'), 'hex')
>> $$ LANGUAGE SQL STRICT IMMUTABLE;
>>
>> While this is a great example, it may expose a database app to
>> vulnerabilities if the attacker succeeds in overriding the function
>> sha1(...) in the app's user context (schema)
> You should read this:
> https://wiki.postgresql.org/wiki/A_Guide_to_CVE-2018-1058%3A_Protect_Your_Search_Path
Yeah. I can't get terribly excited about trying to make this one
example unconditionally-secure; there are dozens if not hundreds
of similar cases in our docs. Trying to make them all safe
against insecure search paths would mostly result in unreadable
examples.
regards, tom lane
^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2021-08-17 18:33 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2021-08-17 16:11 Potential vuln in example for "F.25.1.1. digest()" PG Doc comments form <noreply@postgresql.org>
2021-08-17 18:06 ` David G. Johnston <david.g.johnston@gmail.com>
2021-08-17 18:33 ` Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox