Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:71289
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.176 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <1390168252.12466.72764421.0FBAC6E1@webmail.messagingengine.com>
References: <1390082096.14862.72482025.5D36E64F@webmail.messagingengine.com>
 <52DB2E4D.8000009@sugarcrm.com> <1390096353.18659.72527933.474C16A5@webmail.messagingengine.com>
 <52DB310A.9040506@sugarcrm.com> <1390099947.26938.72538325.1FDD1F20@webmail.messagingengine.com>
 <52DBA5B2.20304@lsces.co.uk> <1390154806.5657.72705681.06A9F994@webmail.messagingengine.com>
 <52DC3CB4.5090503@lsces.co.uk> <1390168252.12466.72764421.0FBAC6E1@webmail.messagingengine.com>
Date: Mon, 20 Jan 2014 10:16:21 +0900
Message-ID: <CAGa2bXYoQcpSXdpUvKs7gn9zDcTj9VTHvOukPe1KYV4EFLRSHA@mail.gmail.com>
To: Will Fitch <willfitch@php.net>
Cc: Lester Caine <lester@lsces.co.uk>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113437961db6dc04f05ca6ba
Subject: Re: [PHP-DEV] Bug 62479
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a113437961db6dc04f05ca6ba
Content-Type: text/plain; charset=UTF-8

Hi Lester,

On Mon, Jan 20, 2014 at 6:50 AM, Will Fitch <willfitch@php.net> wrote:

> On Sun, Jan 19, 2014, at 12:59 PM, Lester Caine wrote:
> > Will Fitch wrote:
> > > On Sun, Jan 19, 2014, at 02:15 AM, Lester Caine wrote:
> > >> >Will Fitch wrote:
> > >>> > >Then again, I didn't expect to have
> > >>> > >a bug where single quotes are part of the password, so there's
> always a
> > >>> > >surprise.
> > >> >
> > >> >Leaving holes that can possibly be used by hackers is the problem
> here.
> > >> >IF
> > >> >someone finds an edge case that does not get handled their next step
> is
> > >> >to see
> > >> >if it can be exploited? Code review is not a matter of 'surprise' but
> > >> >rather
> > >> >'what have I missed that could be a problem'?
> > > I agree.  However, this is more of a situation of not accounting for
> all
> > > situations as opposed to introducing a security flaw.  As I told Stas,
> > > I'm going to update to account for beginning/ending quotes.
> >
> > Many of the edge cases that get missed are quite benign but some of them
> > can be
> > a surprise. It is perhaps a little surprising how some holes can be
> > exploited,
> > even when we thought they were safe :(
>
> Well said. :)


Good point. Older PostgreSQL uses \ as escape char.
There is standard conforming string handling and it is the default
currently.
However, it's a configurable option. It's safe as long as E'str' is used.

Reference: standard_conforming_strings
http://www.postgresql.org/docs/9.1/static/runtime-config-compatible.html

Is this issue considered?

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a113437961db6dc04f05ca6ba--