Skip to content

Conversation

@mmkal
Copy link
Owner

@mmkal mmkal commented Apr 11, 2022

It was possible to make psql accidentally execute statements if they ended with a semicolon. The problem:

echo 'create table foo1(id int); \gdesc' | psql -f -

Actually executes create table foo(id int) and ignores the \gdesc part as an invalid command. This works around by banning semicolons altogether unless they're the last character, in which case they'll be trimmed. Parsing the query would probably be better but it's harder to be sure it's safe that way.

@mmkal mmkal merged commit e040550 into master Apr 11, 2022
@mmkal mmkal deleted the mk/22/04/11/dontletsemicolonscausequeriestobeexecuted branch April 11, 2022 12:38
@janpaepke
Copy link
Collaborator

Woah! Good find!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants