Received: from localhost (unknown [200.46.204.184]) by postgresql.org (Postfix) with ESMTP id A17729F9B11 for ; Mon, 3 Sep 2007 11:09:24 -0300 (ADT) Received: from postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.184]) (amavisd-maia, port 10024) with ESMTP id 21542-01 for ; Mon, 3 Sep 2007 11:09:12 -0300 (ADT) X-Greylist: from auto-whitelisted by SQLgrey-1.7.5 Received: from sss.pgh.pa.us (sss.pgh.pa.us [66.207.139.130]) by postgresql.org (Postfix) with ESMTP id 6FF289F985B for ; Mon, 3 Sep 2007 11:09:21 -0300 (ADT) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.14.1/8.14.1) with ESMTP id l83E93nx008196; Mon, 3 Sep 2007 10:09:04 -0400 (EDT) To: Gregory Stark cc: "Magnus Hagander" , "Oleg Bartunov" , "Pavel Stehule" , "PostgreSQL Hackers" Subject: Re: tsearch filenames unlikes special symbols and numbers In-reply-to: <87zm03zwqs.fsf@oxford.xeocode.com> References: <162867790709021328i7771aa9jfe79268bccbf123d@mail.gmail.com> <18259.1188773171@sss.pgh.pa.us> <87y7foir7t.fsf@oxford.xeocode.com> <19257.1188777110@sss.pgh.pa.us> <87tzqci6tp.fsf@oxford.xeocode.com> <20070903075609.GD21833@svr2.hagander.net> <1692.1188826039@sss.pgh.pa.us> <87zm03zwqs.fsf@oxford.xeocode.com> Comments: In-reply-to Gregory Stark message dated "Mon, 03 Sep 2007 14:47:39 +0100" Date: Mon, 03 Sep 2007 10:09:03 -0400 Message-ID: <8195.1188828543@sss.pgh.pa.us> From: Tom Lane X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200709/86 X-Sequence-Number: 107238 Gregory Stark writes: > "Tom Lane" writes: >> I'm not convinced that . is issue-free. On most if not all versions of Unix, >> you are allowed to open a directory as a file and read the filenames it >> contains. While I don't say it'd be easy to manage that through >> tsearch, there's at least a potential for discovering the filenames >> present in . and .. --- how much do we care about that? > Actually I don't think that's true any more, most file systems on most Unixen > do not allow it. However it appears it's still the case for Solaris so it's > still a good point. Actually, now that I've woken up a bit more, it is not a problem as long as the tsearch code always appends some kind of file extension to what the user gives, such as ".dict". It'll be impossible to name "." or ".." with that addition. Also, Magnus says that Windows throws an error for ":" in the filename, which means we needn't. So the bottom line seems to be that rejecting directory separators is sufficient to prevent any unwanted file accesses. It might still be a good idea to restrict the names to be SQL identifiers (ie, alphanumerics and underscores) for future-proofing, but it wasn't clear whether anyone but me thought that was a good argument. I'm willing to make it just be no-dir-separators. regards, tom lane