diff options
| author | Tom Lane | 2012-02-23 20:53:30 +0000 |
|---|---|---|
| committer | Tom Lane | 2012-02-23 20:53:30 +0000 |
| commit | d975e166052e5992e1d082273f5680e85239b935 (patch) | |
| tree | 1e21ad8b6776d7ea4b5fb4caed2f884d816f4c3d /doc/src | |
| parent | 4ee9db0cd94a1ecfce4f76de29fa213ddc892c6e (diff) | |
Convert newlines to spaces in names written in pg_dump comments.
pg_dump was incautious about sanitizing object names that are emitted
within SQL comments in its output script. A name containing a newline
would at least render the script syntactically incorrect. Maliciously
crafted object names could present a SQL injection risk when the script
is reloaded.
Reported by Heikki Linnakangas, patch by Robert Haas
Security: CVE-2012-0868
Diffstat (limited to 'doc/src')
0 files changed, 0 insertions, 0 deletions