aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorPeter Eisentraut <peter_e@gmx.net>2009-05-05 18:32:17 +0000
committerPeter Eisentraut <peter_e@gmx.net>2009-05-05 18:32:17 +0000
commit40bc4c260508e8a2579bd2106e1f81b6795d147b (patch)
treed2ad86c55d2795e0746a56f93d0c56852b315147 /src
parent616bceb8cb67c4f7641d933d0963373963e7492e (diff)
downloadpostgresql-40bc4c260508e8a2579bd2106e1f81b6795d147b.tar.gz
postgresql-40bc4c260508e8a2579bd2106e1f81b6795d147b.zip
Disable the use of Unicode escapes in string constants (U&'') when
standard_conforming_strings is not on, for security reasons.
Diffstat (limited to 'src')
-rw-r--r--src/backend/parser/scan.l7
-rw-r--r--src/test/regress/expected/strings.out39
-rw-r--r--src/test/regress/sql/strings.sql19
3 files changed, 64 insertions, 1 deletions
diff --git a/src/backend/parser/scan.l b/src/backend/parser/scan.l
index 8551cd27538..eb0fc10c8f3 100644
--- a/src/backend/parser/scan.l
+++ b/src/backend/parser/scan.l
@@ -24,7 +24,7 @@
* Portions Copyright (c) 1994, Regents of the University of California
*
* IDENTIFICATION
- * $PostgreSQL: pgsql/src/backend/parser/scan.l,v 1.151 2009/04/19 21:08:54 tgl Exp $
+ * $PostgreSQL: pgsql/src/backend/parser/scan.l,v 1.152 2009/05/05 18:32:17 petere Exp $
*
*-------------------------------------------------------------------------
*/
@@ -469,6 +469,11 @@ other .
startlit();
}
{xusstart} {
+ if (!standard_conforming_strings)
+ ereport(ERROR,
+ (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+ errmsg("unsafe use of string constant with Unicode escapes"),
+ errdetail("String constants with Unicode escapes cannot be used when standard_conforming_strings is off.")));
SET_YYLLOC();
BEGIN(xus);
startlit();
diff --git a/src/test/regress/expected/strings.out b/src/test/regress/expected/strings.out
index 6b9dc5df9f4..831fb9e2037 100644
--- a/src/test/regress/expected/strings.out
+++ b/src/test/regress/expected/strings.out
@@ -22,6 +22,7 @@ ERROR: syntax error at or near "' - third line'"
LINE 3: ' - third line'
^
-- Unicode escapes
+SET standard_conforming_strings TO on;
SELECT U&'d\0061t\+000061' AS U&"d\0061t\+000061";
data
------
@@ -34,6 +35,18 @@ SELECT U&'d!0061t\+000061' UESCAPE '!' AS U&"d*0061t\+000061" UESCAPE '*';
dat\+000061
(1 row)
+SELECT U&' \' UESCAPE '!' AS "tricky";
+ tricky
+--------
+ \
+(1 row)
+
+SELECT 'tricky' AS U&"\" UESCAPE '!';
+ \
+--------
+ tricky
+(1 row)
+
SELECT U&'wrong: \061';
ERROR: invalid Unicode escape value at or near "\061'"
LINE 1: SELECT U&'wrong: \061';
@@ -46,6 +59,32 @@ SELECT U&'wrong: +0061' UESCAPE '+';
ERROR: invalid Unicode escape character at or near "+'"
LINE 1: SELECT U&'wrong: +0061' UESCAPE '+';
^
+SET standard_conforming_strings TO off;
+SELECT U&'d\0061t\+000061' AS U&"d\0061t\+000061";
+ERROR: unsafe use of string constant with Unicode escapes
+DETAIL: String constants with Unicode escapes cannot be used when standard_conforming_strings is off.
+SELECT U&'d!0061t\+000061' UESCAPE '!' AS U&"d*0061t\+000061" UESCAPE '*';
+ERROR: unsafe use of string constant with Unicode escapes
+DETAIL: String constants with Unicode escapes cannot be used when standard_conforming_strings is off.
+SELECT U&' \' UESCAPE '!' AS "tricky";
+ERROR: unsafe use of string constant with Unicode escapes
+DETAIL: String constants with Unicode escapes cannot be used when standard_conforming_strings is off.
+SELECT 'tricky' AS U&"\" UESCAPE '!';
+ \
+--------
+ tricky
+(1 row)
+
+SELECT U&'wrong: \061';
+ERROR: unsafe use of string constant with Unicode escapes
+DETAIL: String constants with Unicode escapes cannot be used when standard_conforming_strings is off.
+SELECT U&'wrong: \+0061';
+ERROR: unsafe use of string constant with Unicode escapes
+DETAIL: String constants with Unicode escapes cannot be used when standard_conforming_strings is off.
+SELECT U&'wrong: +0061' UESCAPE '+';
+ERROR: unsafe use of string constant with Unicode escapes
+DETAIL: String constants with Unicode escapes cannot be used when standard_conforming_strings is off.
+RESET standard_conforming_strings;
--
-- test conversions between various string types
-- E021-10 implicit casting among the character data types
diff --git a/src/test/regress/sql/strings.sql b/src/test/regress/sql/strings.sql
index 0da88c7b29e..a28c75ac044 100644
--- a/src/test/regress/sql/strings.sql
+++ b/src/test/regress/sql/strings.sql
@@ -17,13 +17,32 @@ SELECT 'first line'
AS "Illegal comment within continuation";
-- Unicode escapes
+SET standard_conforming_strings TO on;
+
+SELECT U&'d\0061t\+000061' AS U&"d\0061t\+000061";
+SELECT U&'d!0061t\+000061' UESCAPE '!' AS U&"d*0061t\+000061" UESCAPE '*';
+
+SELECT U&' \' UESCAPE '!' AS "tricky";
+SELECT 'tricky' AS U&"\" UESCAPE '!';
+
+SELECT U&'wrong: \061';
+SELECT U&'wrong: \+0061';
+SELECT U&'wrong: +0061' UESCAPE '+';
+
+SET standard_conforming_strings TO off;
+
SELECT U&'d\0061t\+000061' AS U&"d\0061t\+000061";
SELECT U&'d!0061t\+000061' UESCAPE '!' AS U&"d*0061t\+000061" UESCAPE '*';
+SELECT U&' \' UESCAPE '!' AS "tricky";
+SELECT 'tricky' AS U&"\" UESCAPE '!';
+
SELECT U&'wrong: \061';
SELECT U&'wrong: \+0061';
SELECT U&'wrong: +0061' UESCAPE '+';
+RESET standard_conforming_strings;
+
--
-- test conversions between various string types
-- E021-10 implicit casting among the character data types