Also unquote a function name followed by a comment
SELECT "pg_read_file" /* x */ ('/etc/passwd') still passed: the check
for a following parenthesis only skipped whitespace. Skip comments too.
This commit is contained in:
@@ -26,6 +26,8 @@ class SqlGuardTest extends TestCase
|
||||
["SELECT dblink_exec('host=x', 'DROP TABLE t')"],
|
||||
["SELECT \"pg_read_file\"('/etc/passwd')"],
|
||||
["SELECT pg_catalog.\"pg_read_file\"('/etc/passwd')"],
|
||||
["SELECT \"pg_read_file\" /* x */ ('/etc/passwd')"],
|
||||
["SELECT \"pg_read_file\"-- x\n('/etc/passwd')"],
|
||||
["SELECT dblink_send_query('c', 'SELECT 1')"],
|
||||
["SELECT * FROM dblink('host=x', 'SELECT 1') AS t(a int)"],
|
||||
["SELECT * FROM t INTO OUTFILE '/tmp/x'"],
|
||||
@@ -127,6 +129,7 @@ class SqlGuardTest extends TestCase
|
||||
["SELECT \"setval\"('seq', 1)"],
|
||||
["SELECT pg_catalog.\"setval\"('seq', 1)"],
|
||||
["SELECT pg_catalog.setval('seq', 1)"],
|
||||
["SELECT \"setval\" /* x */ ('seq', 1)"],
|
||||
['MERGE INTO t USING s ON true WHEN MATCHED THEN DELETE'],
|
||||
['VACUUM'],
|
||||
['PRAGMA journal_mode = WAL'],
|
||||
|
||||
Reference in New Issue
Block a user