From: Laurenz Albe <laurenz.albe@cybertec.at>
To: y.saburov@gmail.com
To: pgsql-docs@lists.postgresql.org
Subject: Re: Possible command-injection or meta-command execution in `psql` input
Date: Mon, 28 Sep 2026 14:51:30 +0200
Message-ID: <fd897878c2324790143f5c4f4caa2b7388b88c68.camel@cybertec.at> (raw)
In-Reply-To: <179041123000.1026192.10336293169834979882@wrigleys.postgresql.org>
References: <179041123000.1026192.10336293169834979882@wrigleys.postgresql.org>
On Sat, 2026-09-26 at 08:27 +0000, PG Doc comments form wrote:
> AI generated ))
Then please validate the generated stuff rather than creating
extra work.
> The following SQL statement contains an unquoted regular-expression-like
> expression:
>
> db=# WITH products (id, name, price, action) AS
> (
> VALUES
> (1, 'apple', 100, '...')
> , (2, 'banana', 200, '...')
> , (3, 'orange', 150, '...')
> , (4, 'potato', 80, '...')
> , (5, 'tomato', 120, '...')
> )
> SELECT
> p.id
> , p.name
> , p.price
> , p.action
> FROM products AS p
> WHERE regexp_like(p.action, ((?<!-)\d+))
> ;
>
> [the complaint is that you get a list of tables rather than a result]
There is no bug there. The statement is *not* a regular expression,
because the single quotes around the string literal are missing.
As a consequence, a metacommand (\d+) is executed. That "swallows"
the two closing parentheses, and psql prompts you to close the two
parentheses and end the statement. If you do that, you get the
syntax error you deserve.
In short: garbage in, garbage out. No bug.
Yours,
Laurenz Albe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: laurenz.albe@cybertec.at, y.saburov@gmail.com, pgsql-docs@lists.postgresql.org
Subject: Re: Possible command-injection or meta-command execution in `psql` input
In-Reply-To: <fd897878c2324790143f5c4f4caa2b7388b88c68.camel@cybertec.at>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox