Block all dblink functions in the SQL mode

Only dblink() and dblink_connect() were blocked, so dblink_exec(),
dblink_send_query() and the other functions of the extension could
still reach other databases. Match every function whose name starts
with dblink.
This commit is contained in:
2026-09-30 16:48:50 +02:00
parent 284e75ddb3
commit d7b093812d
2 changed files with 4 additions and 1 deletions
+1 -1
View File
@@ -27,7 +27,7 @@ class SqlGuard
'/\bpg_stat_file\s*\(/i' => 'pg_stat_file()',
'/\blo_import\s*\(/i' => 'lo_import()',
'/\blo_export\s*\(/i' => 'lo_export()',
'/\bdblink(_connect)?\s*\(/i' => 'dblink() (connects to arbitrary databases)',
'/\bdblink\w*\s*\(/i' => 'dblink functions (connect to arbitrary databases)',
'/\bLOAD_FILE\s*\(/i' => 'LOAD_FILE()',
'/\bINTO\s+(OUTFILE|DUMPFILE)\b/i' => 'INTO OUTFILE/DUMPFILE',
];