diff --git a/doc/src/sgml/runtime.sgml b/doc/src/sgml/runtime.sgml index 547ea5af460..91b59d0f86a 100644 --- a/doc/src/sgml/runtime.sgml +++ b/doc/src/sgml/runtime.sgml @@ -1,5 +1,5 @@ @@ -2396,6 +2396,35 @@ dynamic_library_path = '/usr/local/lib/postgresql:/home/my_project/lib:$libdir' + + backslash_quote (string) + stringsbackslash quotes + + backslash_quote configuration parameter + + + + This controls whether a quote mark can be represented by + \' in a string literal. The preferred, SQL-standard way + to represent a quote mark is by doubling it ('') but + PostgreSQL has historically also accepted + \'. However, use of \' creates security risks + because in some client character set encodings, there are multibyte + characters in which the last byte is numerically equivalent to ASCII + \. If client-side code does escaping incorrectly then a + SQL-injection attack is possible. This risk can be prevented by + making the server reject queries in which a quote mark appears to be + escaped by a backslash. + The allowed values of backslash_quote are + on (allow \' always), + off (reject always), and + safe_encoding (allow only if client encoding does not + allow ASCII \ within a multibyte character). + safe_encoding is the default setting. + + + + regex_flavor (string) regular expressions diff --git a/src/backend/parser/scan.l b/src/backend/parser/scan.l index c87752fc5e4..e714df686dc 100644 --- a/src/backend/parser/scan.l +++ b/src/backend/parser/scan.l @@ -9,7 +9,7 @@ * * * IDENTIFICATION - * $Header: /cvsroot/pgsql/src/backend/parser/scan.l,v 1.111.2.2 2005/08/16 00:48:43 tgl Exp $ + * $Header: /cvsroot/pgsql/src/backend/parser/scan.l,v 1.111.2.3 2006/05/21 20:11:58 tgl Exp $ * *------------------------------------------------------------------------- */ @@ -40,6 +40,15 @@ extern YYSTYPE yylval; static int xcdepth = 0; /* depth of nesting in slash-star comments */ +/* + * GUC variables. This is a DIRECT violation of the warning given at the + * head of gram.y, ie flex/bison code must not depend on any GUC variables; + * as such, changing their values can induce very unintuitive behavior. + * But we shall have to live with it as a short-term thing until the switch + * to SQL-standard string syntax is complete. + */ +BackslashQuoteType backslash_quote = BACKSLASH_QUOTE_SAFE_ENCODING; + /* * literalbuf is used to accumulate literal values when multiple rules * are needed to parse a single literal. Call startlit to reset buffer @@ -54,6 +63,7 @@ static int literalalloc; /* current allocated buffer size */ static void addlit(char *ytext, int yleng); static void addlitchar(unsigned char ychar); static char *litbufdup(void); +static int pg_err_position(void); /* * When we parse a token that requires multiple lexer rules to process, @@ -377,6 +387,17 @@ other . addlit(yytext, yyleng); } {xqescape} { + if (yytext[1] == '\'') + { + if (backslash_quote == BACKSLASH_QUOTE_OFF || + (backslash_quote == BACKSLASH_QUOTE_SAFE_ENCODING && + PG_ENCODING_IS_CLIENT_ONLY(pg_get_client_encoding()))) + ereport(ERROR, + (errcode(ERRCODE_INVALID_USE_OF_ESCAPE_CHARACTER), + errmsg("unsafe use of \\' in a string literal"), + errhint("Use '' to write quotes in strings. \\' is insecure in client-only encodings."), + errposition(pg_err_position()))); + } addlitchar(unescape_single_char(yytext[1])); } {xqoctesc} { @@ -556,14 +577,20 @@ other . %% +static int +pg_err_position(void) +{ + const char *loc = token_start ? token_start : yytext; + + /* in multibyte encodings, return index in characters not bytes */ + return pg_mbstrlen_with_len(scanbuf, loc - scanbuf) + 1; +} + void yyerror(const char *message) { const char *loc = token_start ? token_start : yytext; - int cursorpos; - - /* in multibyte encodings, return index in characters not bytes */ - cursorpos = pg_mbstrlen_with_len(scanbuf, loc - scanbuf) + 1; + int cursorpos = pg_err_position(); if (*loc == YY_END_OF_BUFFER_CHAR) { diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c index c5887f79806..227ecf62fda 100644 --- a/src/backend/utils/misc/guc.c +++ b/src/backend/utils/misc/guc.c @@ -10,7 +10,7 @@ * Written by Peter Eisentraut . * * IDENTIFICATION - * $Header: /cvsroot/pgsql/src/backend/utils/misc/guc.c,v 1.164.2.4 2006/02/12 22:33:28 tgl Exp $ + * $Header: /cvsroot/pgsql/src/backend/utils/misc/guc.c,v 1.164.2.5 2006/05/21 20:11:58 tgl Exp $ * *-------------------------------------------------------------------- */ @@ -42,6 +42,7 @@ #include "optimizer/geqo.h" #include "optimizer/paths.h" #include "optimizer/prep.h" +#include "parser/gramparse.h" #include "parser/parse_expr.h" #include "parser/parse_relation.h" #include "parser/scansup.h" @@ -95,6 +96,8 @@ static const char *assign_msglvl(int *var, const char *newval, bool doit, bool interactive); static const char *assign_log_error_verbosity(const char *newval, bool doit, bool interactive); +static const char *assign_backslash_quote(const char *newval, bool doit, + bool interactive); static bool assign_phony_autocommit(bool newval, bool doit, bool interactive); @@ -144,6 +147,7 @@ static char *log_min_error_statement_str; static bool phony_autocommit; static bool session_auth_is_superuser; static double phony_random_seed; +static char *backslash_quote_string; static char *client_encoding_string; static char *datestyle_string; static char *default_iso_level_string; @@ -1281,6 +1285,15 @@ static struct config_real ConfigureNamesReal[] = static struct config_string ConfigureNamesString[] = { + { + {"backslash_quote", PGC_USERSET, COMPAT_OPTIONS_PREVIOUS, + gettext_noop("Sets whether \"\\'\" is allowed in string literals."), + gettext_noop("Valid values are ON, OFF, and SAFE_ENCODING.") + }, + &backslash_quote_string, + "safe_encoding", assign_backslash_quote, NULL + }, + { {"client_encoding", PGC_USERSET, CLIENT_CONN_LOCALE, gettext_noop("Sets the client's character set encoding."), @@ -4374,6 +4387,32 @@ assign_log_error_verbosity(const char *newval, bool doit, bool interactive) return newval; /* OK */ } +static const char * +assign_backslash_quote(const char *newval, bool doit, bool interactive) +{ + BackslashQuoteType bq; + bool bqbool; + + /* + * Although only "on", "off", and "safe_encoding" are documented, + * we use parse_bool so we can accept all the likely variants of + * "on" and "off". + */ + if (strcasecmp(newval, "safe_encoding") == 0) + bq = BACKSLASH_QUOTE_SAFE_ENCODING; + else if (parse_bool(newval, &bqbool)) + { + bq = bqbool ? BACKSLASH_QUOTE_ON : BACKSLASH_QUOTE_OFF; + } + else + return NULL; /* reject */ + + if (doit) + backslash_quote = bq; + + return newval; +} + static bool assign_phony_autocommit(bool newval, bool doit, bool interactive) { diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample index 1ead89e1308..a211226093f 100644 --- a/src/backend/utils/misc/postgresql.conf.sample +++ b/src/backend/utils/misc/postgresql.conf.sample @@ -247,6 +247,7 @@ # - Previous Postgres Versions - #add_missing_from = true +#backslash_quote = safe_encoding # on, off, or safe_encoding #regex_flavor = advanced # advanced, extended, or basic #sql_inheritance = true diff --git a/src/bin/psql/tab-complete.c b/src/bin/psql/tab-complete.c index 0f7698cc9c0..7fbd5e792c6 100644 --- a/src/bin/psql/tab-complete.c +++ b/src/bin/psql/tab-complete.c @@ -3,7 +3,7 @@ * * Copyright (c) 2000-2003, PostgreSQL Global Development Group * - * $Header: /cvsroot/pgsql/src/bin/psql/tab-complete.c,v 1.91.2.1 2003/11/08 20:54:37 momjian Exp $ + * $Header: /cvsroot/pgsql/src/bin/psql/tab-complete.c,v 1.91.2.2 2006/05/21 20:11:58 tgl Exp $ */ /*---------------------------------------------------------------------- @@ -483,6 +483,7 @@ psql_completion(char *text, int start, int end) */ "add_missing_from", "australian_timezones", + "backslash_quote", "client_encoding", "client_min_messages", "commit_delay", diff --git a/src/include/parser/gramparse.h b/src/include/parser/gramparse.h index 8a165015753..c7e46ea8d2d 100644 --- a/src/include/parser/gramparse.h +++ b/src/include/parser/gramparse.h @@ -7,7 +7,7 @@ * Portions Copyright (c) 1996-2003, PostgreSQL Global Development Group * Portions Copyright (c) 1994, Regents of the University of California * - * $Id: gramparse.h,v 1.28 2003/08/04 02:40:14 momjian Exp $ + * $Id: gramparse.h,v 1.28.4.1 2006/05/21 20:11:58 tgl Exp $ * *------------------------------------------------------------------------- */ @@ -18,6 +18,17 @@ #include "nodes/parsenodes.h" +typedef enum +{ + BACKSLASH_QUOTE_OFF, + BACKSLASH_QUOTE_ON, + BACKSLASH_QUOTE_SAFE_ENCODING +} BackslashQuoteType; + +/* GUC variables in scan.l (every one of these is a bad idea :-() */ +extern BackslashQuoteType backslash_quote; + + /* from parser.c */ extern int yylex(void);