DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=qZ5r4NRB9dFrirab25G2Te0Gj5KuLwSVYZoidV/i60UBqFDt+dHP7fYtBNVPcDyxJS1NOoEvuSSAodkoQSYTSGFv+7vN3PvB6vrPo9/MdgBdD7w7IPuGTpwSg4ljkIZKfqt2cyhkxluieS8xt5dGOCC7XaeI/MiAjB8sNMZeIdw=
Message-ID: <5f211bd50804270148i3f658043o8f7f13852859922b@mail.gmail.com>
Date: Sun, 27 Apr 2008 10:48:55 +0200
From: "Thomas Mueller" <thomas.tom.mueller@gmail.com>
To: "Thomas Kellerer" <spam_eater@gmx.net>
Subject: Re: Protection from SQL injection
Cc: pgsql-sql@postgresql.org
In-Reply-To: <fv0727$cge$1@ger.gmane.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com>
	<fv0727$cge$1@ger.gmane.org>

Hi,

>  I fail to see how the backend could distinguish between a query sent by a
> query tool and a query sent by an "application".

The backend could use a different client library (a client library
that doesn't allow literals). But in this case two or three client
libraries are required.

Probably better is to restrict in the database.

There would be a user (or role) for the query tool and one for the
application. Maybe the SET ALLOW_LITERALS is not such a good idea.
What about REVOKE LITERAL_TEXT FROM APP_ROLE. So LITERAL_TEXT and
LITERAL_NUMBER would be rights (similar to REVOKE USAGE ON LANGUAGE
... FROM ...).

It's an access rights problem. Let's say there is a development
database (DEV_DB) and a production (PROD_DB). There are two users /
roles on those systems: APP_USER (no literals) and QUERY_TOOL_USER
(literals allowed). The passwords are different on each system.
Developers know the password for QUERY_TOOL_USER@DEV_DB and
APP_USER@DEV_DB, but only APP_USER@PROD_DB. Or developers know all
passwords, but the application configuration is rewieved not to use
QUERY_TOOL_USER.

Regards,
Thomas