diff --git a/lib/Service/SqlGuard.php b/lib/Service/SqlGuard.php index 5b10cc1..7af03af 100644 --- a/lib/Service/SqlGuard.php +++ b/lib/Service/SqlGuard.php @@ -27,7 +27,7 @@ class SqlGuard '/\bpg_stat_file\s*\(/i' => 'pg_stat_file()', '/\blo_import\s*\(/i' => 'lo_import()', '/\blo_export\s*\(/i' => 'lo_export()', - '/\bdblink(_connect)?\s*\(/i' => 'dblink() (connects to arbitrary databases)', + '/\bdblink\w*\s*\(/i' => 'dblink functions (connect to arbitrary databases)', '/\bLOAD_FILE\s*\(/i' => 'LOAD_FILE()', '/\bINTO\s+(OUTFILE|DUMPFILE)\b/i' => 'INTO OUTFILE/DUMPFILE', ]; diff --git a/tests/Unit/Service/SqlGuardTest.php b/tests/Unit/Service/SqlGuardTest.php index 69812b8..9091708 100644 --- a/tests/Unit/Service/SqlGuardTest.php +++ b/tests/Unit/Service/SqlGuardTest.php @@ -23,6 +23,9 @@ class SqlGuardTest extends TestCase ["SELECT pg_ls_dir('/')"], ["SELECT lo_import('/etc/passwd')"], ["SELECT dblink_connect('host=x')"], + ["SELECT dblink_exec('host=x', 'DROP TABLE t')"], + ["SELECT dblink_send_query('c', 'SELECT 1')"], + ["SELECT * FROM dblink('host=x', 'SELECT 1') AS t(a int)"], ["SELECT * FROM t INTO OUTFILE '/tmp/x'"], ["COPY (SELECT '/*') TO PROGRAM 'sh' --*/"], ["COPY (SELECT '--') TO PROGRAM 'sh'"],