From: Scott Marlowe <scott.marlowe@gmail.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Thomas Kellerer <spam_eater@gmx.net>
Cc: pgsql-sql@postgresql.org
Subject: Re: Protection from SQL injection
Date: Sat, 26 Apr 2008 21:50:10 -0600
Message-ID: <dcc563d10804262050u3da9f7f8n66bc30596ba63772@mail.gmail.com> (raw)
In-Reply-To: <13670.1209267734@sss.pgh.pa.us>
References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com>
<fv0727$cge$1@ger.gmane.org>
<dcc563d10804261721l68d7dcd1u329d796a8aa8a9b4@mail.gmail.com>
<13670.1209267734@sss.pgh.pa.us>
On Sat, Apr 26, 2008 at 9:42 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> "Scott Marlowe" <scott.marlowe@gmail.com> writes:
> > Wouldn't it be much simpler to have a version of the libpq client lib
> > that only understands prepared queries?
>
> You could do that, but there's still no way for it to know exactly how
> the submitted query was constructed. This would block off the types of
> injections that want to add whole SQL commands, but not ones that just
> subvert the current query (eg adding OR TRUE to see data you shouldn't).
>
> This is really a client problem and only client-side solutions will
> provide meaningful traction for it. In perl, for instance, the "taint"
> mechanism is a good way to notice whether any insecure strings are
> getting into database queries.
Agreed. My point was that to do what the OP wants, wouldn't it make
more sense to just lobotomize libpq so it doesn't understand anything
but prepared queries. Doesn't obviate the need for a client side
language based solution. Just seems to make WAY more sense than
trying to make the change at the server level in pgsql.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: scott.marlowe@gmail.com, tgl@sss.pgh.pa.us, spam_eater@gmx.net
Subject: Re: Protection from SQL injection
In-Reply-To: <dcc563d10804262050u3da9f7f8n66bc30596ba63772@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox