Block all dblink functions in the SQL mode
Only dblink() and dblink_connect() were blocked, so dblink_exec(), dblink_send_query() and the other functions of the extension could still reach other databases. Match every function whose name starts with dblink.
This commit is contained in:
@@ -27,7 +27,7 @@ class SqlGuard
|
||||
'/\bpg_stat_file\s*\(/i' => 'pg_stat_file()',
|
||||
'/\blo_import\s*\(/i' => 'lo_import()',
|
||||
'/\blo_export\s*\(/i' => 'lo_export()',
|
||||
'/\bdblink(_connect)?\s*\(/i' => 'dblink() (connects to arbitrary databases)',
|
||||
'/\bdblink\w*\s*\(/i' => 'dblink functions (connect to arbitrary databases)',
|
||||
'/\bLOAD_FILE\s*\(/i' => 'LOAD_FILE()',
|
||||
'/\bINTO\s+(OUTFILE|DUMPFILE)\b/i' => 'INTO OUTFILE/DUMPFILE',
|
||||
];
|
||||
|
||||
Reference in New Issue
Block a user