mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2025-01-31 10:46:16 +00:00
Code Issues Releases Activity

Close the security hole by making it escape all of the untrusted input

Browse Source 
before passing it to the SQL  server. The code in the added pqescape.c
is going to be in the next PostgreSQL release, but it is not there yet
and this port will use its own private copy for now.

No REVISION  bump since  the port  was forbidden  ever since  the last
upgrade. Submitter reviewed  my tweaks of his patch  and approved them
authorizing (as one of the SOs) the removal of the FORBIDDEN flag.

Submitted by:	nectar
Reviewed by:	nectar
Approved by:	nectar
Obtained from:	http://CERT.uni-stuttgart.de/doc/postgresql/escape/
This commit is contained in:
Mikhail Teterin 2002-01-09 20:49:02 +00:00
parent 396ebf2f43
commit 6c09982b17
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=52829
3 changed files with 71 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
security/pam-pgsql/Makefile
View File

@ -16,8 +16,6 @@ MAINTAINER= mi@aldan.algebra.com
LIB_DEPENDS= pq:${PORTSDIR}/databases/postgresql7
FORBIDDEN= can be broken by carefully crafted password string
# When the family of Debian mirrors is added to bsd.port.mk,
# this will suddenly start making sense:
MASTER_SITE_DEBIAN?= http://ftp.debian.org/debian/%SUBDIR%/
@ -29,7 +27,7 @@ MASTER_SITES_DEBIAN+= http://ftp.au.debian.org/pub/debian/%SUBDIR%/ \
ftp://ftp.bora.net/pub/linux/debian/%SUBDIR%/
MAKEFILE= ${FILESDIR}/Makefile.bsd
MAKE_ARGS+= -j 2
MAKE_ARGS+= -j 2 FILESDIR=${FILESDIR}
post-install:
${CAT} ${PKGMESSAGE}

5
security/pam-pgsql/files/Makefile.bsd
View File

@ -1,6 +1,9 @@
# This makefile is inspired by those in /usr/src/lib/libpam/modules :-)
SRCS= pam_pgsql.c pam_get_pass.c pam_std_option.c pam_get_service.c
.PATH: ${FILESDIR}
SRCS= pam_pgsql.c pam_get_pass.c pam_std_option.c pam_get_service.c \
pqescape.c
LIB= pam_pgsql
SHLIB_NAME=${LIB}.so

66
security/pam-pgsql/files/pqescape.c Normal file
View File

@ -0,0 +1,66 @@
/*
* PQescapeString implementation is from
* <URL:http://cert.uni-stuttgart.de/doc/postgresql/escape/>
* It will be available in a later release of PostGreSQL.
*/
#if !defined(HAVE_PQESCAPESTRING)
#include <sys/types.h>
/* Quoting strings before inclusion in queries. */
size_t PQescapeString (char *to, const char *from, size_t length);
/* ---------------
* Escaping arbitrary strings to get valid SQL strings/identifiers.
*
* Replaces "\\" with "\\\\", "\0" with "\\0", and "'" with "''".
* length is the length of the buffer pointed to by
* from. The buffer at to must be at least 2*length + 1 characters
* long. A terminating NUL character is written.
* ---------------
*/
size_t
PQescapeString (char *to, const char *from, size_t length)
{
const char *source = from;
char *target = to;
unsigned int remaining = length;
while (remaining > 0) {
switch (*source) {
case '\0':
*target = '\\';
target++;
*target = '0';
/* target and remaining are updated below. */
break;
case '\\':
*target = '\\';
target++;
*target = '\\';
/* target and remaining are updated below. */
break;
case '\'':
*target = '\'';
target++;
*target = '\'';
/* target and remaining are updated below. */
break;
default:
*target = *source;
/* target and remaining are updated below. */
}
source++;
target++;
remaining--;
}
/* Write the terminating NUL character. */
*target = '\0';
return target - to;
}
#endif /* !defined(HAVE_PQESCAPESTRING) */