Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Invalid string used for the schema name. When using only numbers #302

Closed
tomturner opened this issue Sep 3, 2019 · 2 comments
Closed

Invalid string used for the schema name. When using only numbers #302

tomturner opened this issue Sep 3, 2019 · 2 comments

Comments

@tomturner
Copy link
Member

tomturner commented Sep 3, 2019

Before I just make a change I wanted to reach out.

I wanted to create a schema name with just number ie 123 however it doesn't work due to a regular expression
SQL_IDENTIFIER_RE = re.compile(r'^[_a-zA-Z][_a-zA-Z0-9]{,62}$')

I have tried to create the schema manually in PgAdmin and PostgreSQL allows it!

Does any mind if I change that regular expression? or do people many we to make it a setting?

@kozlek
Copy link

kozlek commented Sep 24, 2019

I agree to change it because Postgres supports the creation of a schema named 123.
However, simply changing the regex won't work. django-tenants is not escaping the schema name when creating it.

In psql (11.5):
CREATE SCHEMA 123; leads to a syntax error.
CREATE SCHEMA "123"; works.

This behaviour leads to another issue.

CREATE SCHEMA select; leads to a syntax error.
CREATE SCHEMA "select"; works.

Creating a tenant with the schema_name "select" (or any SQL keyword) leads to a Django ProgrammingError. At least, it should be a ValidationError, but this can be supported if we choose to escape the schema_name at the creation.
Hopefully, there is no SQL injection issue as the ";" is not a valid character in the SQL_IDENTIFIER_RE regex and the _check_schema_name function will raise a ValidationError.

@kozlek
Copy link

kozlek commented Sep 24, 2019

#307

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants