Message-ID: <fd897878c2324790143f5c4f4caa2b7388b88c68.camel@cybertec.at>
Subject: Re: Possible command-injection or meta-command execution in `psql`
 input
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: y.saburov@gmail.com, pgsql-docs@lists.postgresql.org
Date: Mon, 28 Sep 2026 14:51:30 +0200
In-Reply-To: 
 <179041123000.1026192.10336293169834979882@wrigleys.postgresql.org>
References: 
 <179041123000.1026192.10336293169834979882@wrigleys.postgresql.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.60.2 (3.60.2-2.fc44) 
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/fd897878c2324790143f5c4f4caa2b7388b88c68.camel%40cybertec.at>
Precedence: bulk

On Sat, 2026-09-26 at 08:27 +0000, PG Doc comments form wrote:
> AI generated ))

Then please validate the generated stuff rather than creating
extra work.

> The following SQL statement contains an unquoted regular-expression-like
> expression:
>=20
> db=3D# WITH products (id, name, price, action) AS
> (
> VALUES
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (1, 'apple',=C2=A0 100, '...')
> =C2=A0=C2=A0=C2=A0=C2=A0 , (2, 'banana', 200, '...')
> =C2=A0=C2=A0=C2=A0=C2=A0 , (3, 'orange', 150, '...')
> =C2=A0=C2=A0=C2=A0=C2=A0 , (4, 'potato',=C2=A0 80, '...')
> =C2=A0=C2=A0=C2=A0=C2=A0 , (5, 'tomato', 120, '...')
> )
> SELECT
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 p.id
> =C2=A0=C2=A0=C2=A0=C2=A0 , p.name
> =C2=A0=C2=A0=C2=A0=C2=A0 , p.price
> =C2=A0=C2=A0=C2=A0=C2=A0 , p.action
> =C2=A0 FROM products AS p
> =C2=A0WHERE regexp_like(p.action, ((?<!-)\d+))
> ;
>
> [the complaint is that you get a list of tables rather than a result]

There is no bug there.  The statement is *not* a regular expression,
because the single quotes around the string literal are missing.
As a consequence, a metacommand (\d+) is executed.  That "swallows"
the two closing parentheses, and psql prompts you to close the two
parentheses and end the statement.  If you do that, you get the
syntax error you deserve.

In short: garbage in, garbage out.  No bug.

Yours,
Laurenz Albe