Subject: Re: Request for Code Review: BPGSQL
To: Rich Jones <miserlou@gmail.com>, pgsql-hackers@postgresql.org
References: 
 <CADJYzxJ2JZ-G0cs-pL-5Hp8DSBpBo1gu2O4-Yq9g2-R_hZ2A9g@mail.gmail.com>
From: Jacek Wielemborek <d33tah@gmail.com>
Message-ID: <56BC8C11.1000505@gmail.com>
Date: Thu, 11 Feb 2016 14:26:41 +0100
MIME-Version: 1.0
In-Reply-To: 
 <CADJYzxJ2JZ-G0cs-pL-5Hp8DSBpBo1gu2O4-Yq9g2-R_hZ2A9g@mail.gmail.com>
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="V7aXAuatuW4KW7V45dIl8iPSnQfHxdBAL"
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--V7aXAuatuW4KW7V45dIl8iPSnQfHxdBAL
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

W dniu 11.02.2016 o 14:06, Rich Jones pisze:
> Hello, team!
>=20
> I am writing on behalf of the BPGSQL Project [1] to request a code audi=
t
> from a core PGSQL team member.
>=20
> The current maintainer is worried about the security of the code, and i=
s
> considering closing the project unless it can be properly reviewed [2].=
 As
> a project living downstream[3] of that client library, I'd obviously mu=
ch
> rather see that project get reviewed rather than see it die.
>=20
> Would anybody here be so kind as to volunteer to give BPGSQL a code rev=
iew
> from an upstream developer's perspective? It would have a lot of value
> downstream users who want to use Postgres on Amazon RDS for serverless
> applications, and I'm sure in plenty of other places.
>=20
> Thanks very much!,
> Rich Jones
>=20
> [1] https://github.com/d33tah/bpgsql
> [2] https://github.com/d33tah/bpgsql/issues/7
> [3] https://github.com/Miserlou/django-zappa/issues/3
>=20

Hello,

Thanks Rich, I second the request for a code review.

I felt I'd add that this is a 1500-line pure-Python PostgreSQL client
module that I inherited after Barry Pederson. After I realized how
execute() is implemented, I have my worries and I'd rather not risk
making my users vulnerable.

I'd be really grateful if somebody who knows a bit of Python and the
guts of PostgreSQL could speak up on this one.

Cheers,
d33tah


--V7aXAuatuW4KW7V45dIl8iPSnQfHxdBAL
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJWvIwRAAoJEGlViymZXJRv7AEQAJAatfNdQqGi+kkrkZjTO3cs
BaTp2sudBZouTJdzZ6s9Qj3Gd+k96LTctH24+e3KZbbhalQsGkEQHEZ5iymPEYOF
HVjO6Dh9tqUShd04VWfilABQAMRyHLKqsqHjiOfP+s6+UUlIFuJf4e8p2jweS60C
82SbC90PacwivosIYwNbDBM+ZfYHjgA+Rdtx+ApqNvCPpJx4kAhuDwA0KgN/t7uw
dQedZQHQYhDGl/eiGVGdfIhxRWlsxkTu0204p49Mt3UenNV+2KbJ2OqnkNYwIskQ
LGyRZQz/dU97uDHfaqDt15zlA3gHH48sASdOrAU9CN9zBdG3Yj7xPj3IAcLyiV+g
2TYsM72UUBocXWXYDQh39tWBhe5ljNOV1pbe9kpWZqxCgAq5lqgVVyvi96vQ/DiK
7y+yv7cB+6g5T/Kc4mlNpm5xN9o/ahlTdPSdzbLTVad97JMfXw/+N/oajZ4IM78j
2ih/9uGKQkO8dxGT0he4o7AjfidXV7SR1BiyM7yQsnxEp5Zq4XMVLoKvMuGojxly
Y4IeZNEJP3qp0UXpsthlxaKhjn2xaAJNy7Ljf9QeN4NCn3bCnn0Tnwe91MsH8CGf
grJFZ3odvLhmQu1XtIqivQBxMO7/Bv/ihnycfGFjYnJyAv/xCjMpC4brWkkXEq6p
/RPTEVeZ2IKbYH8s/XLV
=al9O
-----END PGP SIGNATURE-----

--V7aXAuatuW4KW7V45dIl8iPSnQfHxdBAL--