Re: \gsetenv

2020-12-20 Thread Tom Lane
names x, y, z doesn't mean it *will*, if the server is malicious. psql isn't bright enough to understand what column names the query ought to produce, so it just believes the column names that come back in the query result. > Would a "\gsetenv (col1, col2, col3, skip, col4)"

Re: \gsetenv

2020-12-20 Thread David G. Johnston
able to alter those names. Or *is* that the problem - the server might decide to send back a column named "breakme1" in the first column position even though the user aliased the column name as "col1"? Would a "\gsetenv (col1, col2, col3, skip, col4)" be acceptable tha

Re: \gsetenv

2020-12-20 Thread David Fetter
On Sun, Dec 20, 2020 at 10:42:40PM +0200, Heikki Linnakangas wrote: > On 20/12/2020 21:05, David Fetter wrote: > > We have plenty of ways to spawn shells and cause havoc, and we > > wouldn't be able to block them all even if we decided to put a bunch > > of pretty onerous restrictions on psql at th

Re: \gsetenv

2020-12-20 Thread Heikki Linnakangas
On 20/12/2020 21:05, David Fetter wrote: We have plenty of ways to spawn shells and cause havoc, and we wouldn't be able to block them all even if we decided to put a bunch of pretty onerous restrictions on psql at this very late date. We have \set, backticks, \!, and bunches of things less obvio

Re: \gsetenv

2020-12-20 Thread David Fetter
On Sun, Dec 20, 2020 at 01:07:12PM -0500, Tom Lane wrote: > David Fetter writes: > > On Sun, Dec 20, 2020 at 02:26:14PM +0100, Fabien COELHO wrote: > >> SELECT 'Calvin' AS foo \gset > >> \setenv FOO :foo > >> \! echo $FOO > >> Calvin > > > You're the second person who's mentioned this workaround,

Re: \gsetenv

2020-12-20 Thread Tom Lane
David Fetter writes: > On Sun, Dec 20, 2020 at 02:26:14PM +0100, Fabien COELHO wrote: >> SELECT 'Calvin' AS foo \gset >> \setenv FOO :foo >> \! echo $FOO >> Calvin > You're the second person who's mentioned this workaround, which goes > to a couple of points I tried to make earlier: > - This is

Re: \gsetenv

2020-12-20 Thread David Fetter
On Sun, Dec 20, 2020 at 02:26:14PM +0100, Fabien COELHO wrote: > Hello David, > > > We have \gset to set some parameters, but not ones in the environment, > > so I fixed this with a new analogous command, \gsetenv. I considered > > refactoring SetVariable to include enviro

Re: \gsetenv

2020-12-20 Thread Fabien COELHO
Hello David, We have \gset to set some parameters, but not ones in the environment, so I fixed this with a new analogous command, \gsetenv. I considered refactoring SetVariable to include environment variables, but for a first cut, I just made a separate function and an extra if. My 0.02

Re: \gsetenv

2020-12-17 Thread Andrew Dunstan
aces, but only when I put together > a pretty baroque procedure that involved using combinations of \gset, > \o, and \!. All of the same things \gsetenv could do were doable with > those, just less convenient, so I drafted up a patch in the hope that > fewer others would find themselves jump

Re: \gsetenv

2020-12-16 Thread David Fetter
On Wed, Dec 16, 2020 at 05:30:13PM -0500, Tom Lane wrote: > David Fetter writes: > > We have \gset to set some parameters, but not ones in the environment, > > so I fixed this with a new analogous command, \gsetenv. > > In view of the security complaints we just had about \g

Re: \gsetenv

2020-12-16 Thread Tom Lane
David Fetter writes: > We have \gset to set some parameters, but not ones in the environment, > so I fixed this with a new analogous command, \gsetenv. In view of the security complaints we just had about \gset (CVE-2020-25696), I cannot fathom why we'd consider adding another w

\gsetenv

2020-12-16 Thread David Fetter
Hi, We have \gset to set some parameters, but not ones in the environment, so I fixed this with a new analogous command, \gsetenv. I considered refactoring SetVariable to include environment variables, but for a first cut, I just made a separate function and an extra if. Best, David. -- David