Skip to content

Commit 40bc4c2

Browse files
peterepetere
committed
Disable the use of Unicode escapes in string constants (U&'') when
standard_conforming_strings is not on, for security reasons.
1 parent 616bceb commit 40bc4c2

File tree

4 files changed

+76
-2
lines changed

4 files changed

+76
-2
lines changed

‎doc/src/sgml/syntax.sgml

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $PostgreSQL: pgsql/doc/src/sgml/syntax.sgml,v 1.131 2009/04/27 16:27:36 momjian Exp $ -->
1+
<!-- $PostgreSQL: pgsql/doc/src/sgml/syntax.sgml,v 1.132 2009/05/05 18:32:17 petere Exp $ -->
22

33
<chapter id="sql-syntax">
44
<title>SQL Syntax</title>
@@ -499,6 +499,17 @@ U&amp;'d!0061t!+000061' UESCAPE '!'
499499
specified.
500500
</para>
501501

502+
<para>
503+
Also, the Unicode escape syntax for string constants only works
504+
when the configuration
505+
parameter <xref linkend="guc-standard-conforming-strings"> is
506+
turned on. This is because otherwise this syntax could confuse
507+
clients that parse the SQL statements to the point that it could
508+
lead to SQL injections and similar security issues. If the
509+
parameter is set to off, this syntax will be rejected with an
510+
error message.
511+
</para>
512+
502513
<para>
503514
To include the escape character in the string literally, write it
504515
twice.

‎src/backend/parser/scan.l

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
* Portions Copyright (c) 1994, Regents of the University of California
2525
*
2626
* IDENTIFICATION
27-
* $PostgreSQL: pgsql/src/backend/parser/scan.l,v 1.151 2009/04/19 21:08:54 tgl Exp $
27+
* $PostgreSQL: pgsql/src/backend/parser/scan.l,v 1.152 2009/05/05 18:32:17 petere Exp $
2828
*
2929
*-------------------------------------------------------------------------
3030
*/
@@ -469,6 +469,11 @@ other .
469469
startlit();
470470
}
471471
{xusstart} {
472+
if (!standard_conforming_strings)
473+
ereport(ERROR,
474+
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
475+
errmsg("unsafe use of string constant with Unicode escapes"),
476+
errdetail("String constants with Unicode escapes cannot be used when standard_conforming_strings is off.")));
472477
SET_YYLLOC();
473478
BEGIN(xus);
474479
startlit();

‎src/test/regress/expected/strings.out

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ ERROR: syntax error at or near "' - third line'"
2222
LINE 3: ' - third line'
2323
^
2424
-- Unicode escapes
25+
SET standard_conforming_strings TO on;
2526
SELECT U&'d\0061t\+000061' AS U&"d\0061t\+000061";
2627
data
2728
------
@@ -34,6 +35,18 @@ SELECT U&'d!0061t\+000061' UESCAPE '!' AS U&"d*0061t\+000061" UESCAPE '*';
3435
dat\+000061
3536
(1 row)
3637

38+
SELECT U&' \' UESCAPE '!' AS "tricky";
39+
tricky
40+
--------
41+
\
42+
(1 row)
43+
44+
SELECT 'tricky' AS U&"\" UESCAPE '!';
45+
\
46+
--------
47+
tricky
48+
(1 row)
49+
3750
SELECT U&'wrong: \061';
3851
ERROR: invalid Unicode escape value at or near "\061'"
3952
LINE 1: SELECT U&'wrong: \061';
@@ -46,6 +59,32 @@ SELECT U&'wrong: +0061' UESCAPE '+';
4659
ERROR: invalid Unicode escape character at or near "+'"
4760
LINE 1: SELECT U&'wrong: +0061' UESCAPE '+';
4861
^
62+
SET standard_conforming_strings TO off;
63+
SELECT U&'d\0061t\+000061' AS U&"d\0061t\+000061";
64+
ERROR: unsafe use of string constant with Unicode escapes
65+
DETAIL: String constants with Unicode escapes cannot be used when standard_conforming_strings is off.
66+
SELECT U&'d!0061t\+000061' UESCAPE '!' AS U&"d*0061t\+000061" UESCAPE '*';
67+
ERROR: unsafe use of string constant with Unicode escapes
68+
DETAIL: String constants with Unicode escapes cannot be used when standard_conforming_strings is off.
69+
SELECT U&' \' UESCAPE '!' AS "tricky";
70+
ERROR: unsafe use of string constant with Unicode escapes
71+
DETAIL: String constants with Unicode escapes cannot be used when standard_conforming_strings is off.
72+
SELECT 'tricky' AS U&"\" UESCAPE '!';
73+
\
74+
--------
75+
tricky
76+
(1 row)
77+
78+
SELECT U&'wrong: \061';
79+
ERROR: unsafe use of string constant with Unicode escapes
80+
DETAIL: String constants with Unicode escapes cannot be used when standard_conforming_strings is off.
81+
SELECT U&'wrong: \+0061';
82+
ERROR: unsafe use of string constant with Unicode escapes
83+
DETAIL: String constants with Unicode escapes cannot be used when standard_conforming_strings is off.
84+
SELECT U&'wrong: +0061' UESCAPE '+';
85+
ERROR: unsafe use of string constant with Unicode escapes
86+
DETAIL: String constants with Unicode escapes cannot be used when standard_conforming_strings is off.
87+
RESET standard_conforming_strings;
4988
--
5089
-- test conversions between various string types
5190
-- E021-10 implicit casting among the character data types

‎src/test/regress/sql/strings.sql

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,32 @@ SELECT 'first line'
1717
AS "Illegal comment within continuation";
1818

1919
-- Unicode escapes
20+
SET standard_conforming_strings TO on;
21+
22+
SELECT U&'d\0061t\+000061' AS U&"d\0061t\+000061";
23+
SELECT U&'d!0061t\+000061' UESCAPE '!' AS U&"d*0061t\+000061" UESCAPE '*';
24+
25+
SELECT U&' \' UESCAPE '!' AS "tricky";
26+
SELECT 'tricky' AS U&"\" UESCAPE '!';
27+
28+
SELECT U&'wrong: \061';
29+
SELECT U&'wrong: \+0061';
30+
SELECT U&'wrong: +0061' UESCAPE '+';
31+
32+
SET standard_conforming_strings TO off;
33+
2034
SELECT U&'d\0061t\+000061' AS U&"d\0061t\+000061";
2135
SELECT U&'d!0061t\+000061' UESCAPE '!' AS U&"d*0061t\+000061" UESCAPE '*';
2236
37+
SELECT U&' \' UESCAPE '!' AS "tricky";
38+
SELECT 'tricky' AS U&"\" UESCAPE '!';
39+
2340
SELECT U&'wrong: \061';
2441
SELECT U&'wrong: \+0061';
2542
SELECT U&'wrong: +0061' UESCAPE '+';
2643
44+
RESET standard_conforming_strings;
45+
2746
--
2847
-- test conversions between various string types
2948
-- E021-10 implicit casting among the character data types

0 commit comments

Comments
 (0)