database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-31 22:04:40 +03:00
Code Activity

Sort out paired double quotes in \connect, \password and \crosstabview.

Browse Source 
In arguments, these meta-commands wrongly treated each pair as closing
the double quoted string.  Make the behavior match the documentation.
This is a compatibility break, but I more expect to find software with
untested reliance on the documented behavior than software reliant on
today's behavior.  Back-patch to 9.1 (all supported versions).

Reviewed by Tom Lane and Peter Eisentraut.

Security: CVE-2016-5424
This commit is contained in:
Noah Misch
2016-08-08 10:07:46 -04:00
parent a1f8b6bd14
commit 984e5beb38
3 changed files with 12 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/bin/psql/psqlscanslash.l
View File

@ -671,7 +671,8 @@ dequote_downcase_identifier(char *str, bool downcase, int encoding)
/* Keep the first quote, remove the second */ /* Keep the first quote, remove the second */
cp++; cp++;
} }
inquotes = !inquotes; else
inquotes = !inquotes;
/* Collapse out quote at *cp */ /* Collapse out quote at *cp */
memmove(cp, cp + 1, strlen(cp)); memmove(cp, cp + 1, strlen(cp));
/* do not advance cp */ /* do not advance cp */

16
src/test/regress/expected/psql_crosstab.out
View File

@ -46,19 +46,19 @@ SELECT v, to_char(d, 'Mon') AS "month name", EXTRACT(month FROM d) AS num,
(3 rows) (3 rows)
-- ordered months in vertical header, ordered years in horizontal header -- ordered months in vertical header, ordered years in horizontal header
SELECT EXTRACT(year FROM d) AS year, to_char(d,'Mon') AS "month name", SELECT EXTRACT(year FROM d) AS year, to_char(d,'Mon') AS """month"" name",
EXTRACT(month FROM d) AS month, EXTRACT(month FROM d) AS month,
format('sum=%s avg=%s', sum(i), avg(i)::numeric(2,1)) format('sum=%s avg=%s', sum(i), avg(i)::numeric(2,1))
FROM ctv_data FROM ctv_data
GROUP BY EXTRACT(year FROM d), to_char(d,'Mon'), EXTRACT(month FROM d) GROUP BY EXTRACT(year FROM d), to_char(d,'Mon'), EXTRACT(month FROM d)
ORDER BY month ORDER BY month
\crosstabview "month name" year format year \crosstabview """month"" name" year format year
month name | 2014 | 2015 "month" name | 2014 | 2015
------------+-----------------+---------------- --------------+-----------------+----------------
Jan | | sum=3 avg=3.0 Jan | | sum=3 avg=3.0
Apr | | sum=10 avg=5.0 Apr | | sum=10 avg=5.0
Jul | sum=5 avg=5.0 | sum=4 avg=4.0 Jul | sum=5 avg=5.0 | sum=4 avg=4.0
Dec | sum=-3 avg=-3.0 | Dec | sum=-3 avg=-3.0 |
(4 rows) (4 rows)
-- combine contents vertically into the same cell (V/H duplicates) -- combine contents vertically into the same cell (V/H duplicates)

4
src/test/regress/sql/psql_crosstab.sql
View File

@ -29,13 +29,13 @@ SELECT v, to_char(d, 'Mon') AS "month name", EXTRACT(month FROM d) AS num,
\crosstabview v "month name" 4 num \crosstabview v "month name" 4 num
-- ordered months in vertical header, ordered years in horizontal header -- ordered months in vertical header, ordered years in horizontal header
SELECT EXTRACT(year FROM d) AS year, to_char(d,'Mon') AS "month name", SELECT EXTRACT(year FROM d) AS year, to_char(d,'Mon') AS """month"" name",
EXTRACT(month FROM d) AS month, EXTRACT(month FROM d) AS month,
format('sum=%s avg=%s', sum(i), avg(i)::numeric(2,1)) format('sum=%s avg=%s', sum(i), avg(i)::numeric(2,1))
FROM ctv_data FROM ctv_data
GROUP BY EXTRACT(year FROM d), to_char(d,'Mon'), EXTRACT(month FROM d) GROUP BY EXTRACT(year FROM d), to_char(d,'Mon'), EXTRACT(month FROM d)
ORDER BY month ORDER BY month
\crosstabview "month name" year format year \crosstabview """month"" name" year format year
-- combine contents vertically into the same cell (V/H duplicates) -- combine contents vertically into the same cell (V/H duplicates)
SELECT v, h, string_agg(c, E'\n') FROM ctv_data GROUP BY v, h ORDER BY 1,2,3 SELECT v, h, string_agg(c, E'\n') FROM ctv_data GROUP BY v, h ORDER BY 1,2,3