CVSROOT: /cvsroot
Module name: pgsql-server
Changes by: [EMAIL PROTECTED] 03/08/07 14:56:27
Modified files:
src/interfaces/jdbc/org/postgresql: Tag: REL7_3_STABLE
Driver.java.in
src/interfaces/jdbc/org/postgresql/jdbc1: Tag: REL7_3_STABLE
AbstractJdbc1Statement.java
Log message:
Backport to 7.3. Third try to fix the sql injection
vulnerability. This fix completely removes the ability (hack) of being able
to bind a list of values in an in clause. It was demonstrated that by allowing
that functionality you open up the possibility for certain types of
sql injection attacks. The previous fix attempts all focused on preventing
the insertion of additional sql statements (the semi-colon problem:
xxx; any new sql statement here). But that still left the ability to
change the where clause on the current statement or perform a subselect
which can circumvent applicaiton security logic and/or allow you to call
any stored function.
Modified Files:
Tag: REL7_3_STABLE
jdbc/org/postgresql/Driver.java.in
jdbc/org/postgresql/jdbc1/AbstractJdbc1Statement.java
---------------------------(end of broadcast)---------------------------
TIP 3: if posting/reading through Usenet, please send an appropriate
subscribe-nomail command to [EMAIL PROTECTED] so that your
message can get through to the mailing list cleanly
