Bruce Momjian <[email protected]> writes:
> Tom Lane wrote:
>> Bruce Momjian <[email protected]> writes:
>>> I have reviewed is_absolute_path() and have implemented
>>> path_is_relative_and_below_cwd() to cleanly handle cases like 'E:abc' on
>>> Win32; patch attached.
>>
>> This patch appears to remove some security-critical restrictions.
>> Why did you delete the path_contains_parent_reference calls?
> They are now in path_is_relative_and_below_cwd(),
... and thus not invoked in the absolute-path case. This is a security
hole.
> I don't see a general reason to prevent
> ".." in absolute paths, only relative ones.
load '/path/to/database/../../../path/to/anywhere'
regards, tom lane
--
Sent via pgsql-hackers mailing list ([email protected])
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
