Re: Table Lookup - Database Injections?

2021-10-13 Thread raf
On Wed, Oct 13, 2021 at 03:35:22PM -0400, post...@ptld.com wrote: > > Also since this is table lookup and AFAIK postfix doesn't have to > > write anything on it, so you can give SELECT only right. > > Least privileges are the key... > > > > So even if there is a clever guy that found a way to

Re: Table Lookup - Database Injections?

2021-10-13 Thread postfix
Also since this is table lookup and AFAIK postfix doesn't have to write anything on it, so you can give SELECT only right. Least privileges are the key... So even if there is a clever guy that found a way to escape and send SQL injection he can never insert something.. end of the game for this

Re: Table Lookup - Database Injections?

2021-10-13 Thread Xavier Beaudouin
>> You might want to use a UTF-8 encoding when creating the database and >> choose the same on the client end. > > Thank for the pointer. Also since this is table lookup and AFAIK postfix doesn't have to write anything on it, so you can give SELECT only right. Least privileges are the key...

Re: Table Lookup - Database Injections?

2021-10-13 Thread postfix
You might want to use a UTF-8 encoding when creating the database and choose the same on the client end. Thank for the pointer.

Re: Table Lookup - Database Injections?

2021-10-13 Thread Viktor Dukhovni
On Wed, Oct 13, 2021 at 12:27:30PM -0400, post...@ptld.com wrote: > I received the following logged errors > > query failed: Illegal mix of collations >(latin1_swedish_ci,IMPLICIT) and > (utf8mb4_general_ci,COERCIBLE) for operation '=' > > query = SELECT email FROM aliases WHERE

Table Lookup - Database Injections?

2021-10-13 Thread postfix
I received the following logged errors postfix/smtpd[126515]: connect from mx1.testo.tel[52.39.45.118] postfix/proxymap[126516]: warning: mysql:/etc/postfix/mysql_email_aliases: query failed: Illegal mix of collations (latin1_swedish_ci,IMPLICIT) and (utf8mb4_general_ci,COERCIBLE) for