Feedback-ID: i76984098:Fastmail
Message-ID: <f3121fe0-bd93-40c9-b176-05e6f1f04b69@aklaver.com>
Date: Sat, 7 Jun 2025 15:06:27 -0700
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Feature request: Settings to disable comments and multiple
 statements in a connection
From: Adrian Klaver <adrian.klaver@aklaver.com>
To: Glen K <glenk1973@hotmail.com>, Tom Lane <tgl@sss.pgh.pa.us>
Cc: "pgsql-general@lists.postgresql.org" <pgsql-general@lists.postgresql.org>
References: <BN0P223MB0152E29A351757553BB74C19A86CA@BN0P223MB0152.NAMP223.PROD.OUTLOOK.COM>
 <1079732.1749078352@sss.pgh.pa.us>
 <BN0P223MB01527999F0D58FEB13757986A869A@BN0P223MB0152.NAMP223.PROD.OUTLOOK.COM>
 <bbdb4e11-9743-4862-9a3c-f7cc7f5022d3@aklaver.com>
Content-Language: en-US
In-Reply-To: <bbdb4e11-9743-4862-9a3c-f7cc7f5022d3@aklaver.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Archived-At: <https://www.postgresql.org/message-id/f3121fe0-bd93-40c9-b176-05e6f1f04b69%40aklaver.com>
Precedence: bulk

On 6/7/25 14:56, Adrian Klaver wrote:
> On 6/7/25 14:18, Glen K wrote:
>>>  I don't believe that this would move the needle on SQL-injection
>> safety by enough to be worth doing.  An injection attack is normally
>> trying to break out of a quoted string, not a comment.
>>
>> Yes, SQL injections frequently involve escaping quoted strings, but if 
>> you do a search for SQL injection examples, you will find that most of 
>> them (I would say 90% or more) also use comments to remove the 
>> remainder of the SQL statement from consideration. Here is one example 
>> where an attacker specifies "admin'--;" as the username:
>>
>> SELECT * FROM members WHERE username = 'admin'--;' AND password = 
>> 'password';
>>
>> The comment in this example removes the password from inclusion in the 
>> statement, allowing the attacker to login as admin without a password.
> 
> Really?
> 
> select username, first_name, last_name from auth_user where username = 
> 'aklaver';
> 
>   username | first_name | last_name
> ----------+------------+-----------
>   aklaver  | Adrian     | Klaver
> 
>   select username, first_name, last_name from auth_user where username = 
> 'aklaver--;' and password = 'password';
> 
>   username | first_name | last_name
> ----------+------------+-----------
> (0 rows)

Oops, missed a quote:

select username, first_name, last_name from auth_user where username = 
'aklaver'--;' and password = 'password';
production-#

Still I don't see how this would work, even if you add another ';' and got:

production=# select username, first_name, last_name from auth_user where 
username = 'aklaver'--;' and password = 'password';
production-# ;
  username | first_name | last_name
----------+------------+-----------
  aklaver  | Adrian     | Klaver


> 
> What authentication system are you using that does not actually verify 
> the password and allows entry for a zero return result?
> 
> 

-- 
Adrian Klaver
adrian.klaver@aklaver.com