From: Thomas Mueller <thomas.tom.mueller@gmail.com>
To: Thomas Kellerer <spam_eater@gmx.net>
Cc: pgsql-sql@postgresql.org
Subject: Re: Protection from SQL injection
Date: Sun, 27 Apr 2008 10:48:55 +0200
Message-ID: <5f211bd50804270148i3f658043o8f7f13852859922b@mail.gmail.com> (raw)
In-Reply-To: <fv0727$cge$1@ger.gmane.org>
References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com>
<fv0727$cge$1@ger.gmane.org>
Hi,
> I fail to see how the backend could distinguish between a query sent by a
> query tool and a query sent by an "application".
The backend could use a different client library (a client library
that doesn't allow literals). But in this case two or three client
libraries are required.
Probably better is to restrict in the database.
There would be a user (or role) for the query tool and one for the
application. Maybe the SET ALLOW_LITERALS is not such a good idea.
What about REVOKE LITERAL_TEXT FROM APP_ROLE. So LITERAL_TEXT and
LITERAL_NUMBER would be rights (similar to REVOKE USAGE ON LANGUAGE
... FROM ...).
It's an access rights problem. Let's say there is a development
database (DEV_DB) and a production (PROD_DB). There are two users /
roles on those systems: APP_USER (no literals) and QUERY_TOOL_USER
(literals allowed). The passwords are different on each system.
Developers know the password for QUERY_TOOL_USER@DEV_DB and
APP_USER@DEV_DB, but only APP_USER@PROD_DB. Or developers know all
passwords, but the application configuration is rewieved not to use
QUERY_TOOL_USER.
Regards,
Thomas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: thomas.tom.mueller@gmail.com, spam_eater@gmx.net
Subject: Re: Protection from SQL injection
In-Reply-To: <5f211bd50804270148i3f658043o8f7f13852859922b@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox