Date: Sat, 15 Feb 2025 17:55:12 +0100
From: Christoph Berg <myon@debian.org>
To: Andres Freund <andres@anarazel.de>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Justin Pryzby <pryzby@telsasoft.com>,
	pgsql-hackers@lists.postgresql.org
Subject: Re: pg17.3 PQescapeIdentifier() ignores len
Message-ID: <Z7DG8LX-vEt7Asdy@msg.df7cb.de>
References: <Z64jD3u46gObCo1p@pryzbyj2023>
 <3718360.1739473209@sss.pgh.pa.us>
 <bukicrp3akqomk7lf6ywa7faxhxdnlcxnwfqx7tyeylemps2qi@gfrmkafkmcjx>
 <Z7CJsvNP95cv7euy@msg.df7cb.de>
 <fvwrbxnsqnihwcrsrxkcl2qobnrua7syxnupnqpt6jevzn77g5@ozgmpn7dicdn>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <fvwrbxnsqnihwcrsrxkcl2qobnrua7syxnupnqpt6jevzn77g5@ozgmpn7dicdn>
Archived-At: 
 <https://www.postgresql.org/message-id/Z7DG8LX-vEt7Asdy%40msg.df7cb.de>
Precedence: bulk

Re: Andres Freund
> > What's missing in the PG regression tests to see that problem?
> 
> Well, the expanded tests added as part of the fix would catch it, but I agree,
> it's a problem this wasn't caught beforehand.

Oh sorry, I was actually skimming the git log to see if there is a
test, but then failed to realize there is one. Thanks!

> I don't think that common uses of PQescapeIdentifier/Literal are likely to
> catch the problem, so it's perhaps not too surprising it wasn't caught. Which,
> I guess, shows that we really need more explicit edge-case coverage of at
> least the most crucial APIs (we barely have any).  There's pretty much no way
> that pg_regress or TAP test style tests are going to catch a problem like
> this.

What I can do is to trigger regression tests on all packages on
apt.postgresql.org after the minor releases have been built and then
raise any flags before the release goes out.

Except that pygresql isn't yet a package on apt.pg.o... will fix that
now. This time, the problem was caught by Debian's CI machinery.

Christoph