Block all dblink functions in the SQL mode
Only dblink() and dblink_connect() were blocked, so dblink_exec(), dblink_send_query() and the other functions of the extension could still reach other databases. Match every function whose name starts with dblink.
This commit is contained in:
@@ -23,6 +23,9 @@ class SqlGuardTest extends TestCase
|
||||
["SELECT pg_ls_dir('/')"],
|
||||
["SELECT lo_import('/etc/passwd')"],
|
||||
["SELECT dblink_connect('host=x')"],
|
||||
["SELECT dblink_exec('host=x', 'DROP TABLE t')"],
|
||||
["SELECT dblink_send_query('c', 'SELECT 1')"],
|
||||
["SELECT * FROM dblink('host=x', 'SELECT 1') AS t(a int)"],
|
||||
["SELECT * FROM t INTO OUTFILE '/tmp/x'"],
|
||||
["COPY (SELECT '/*') TO PROGRAM 'sh' --*/"],
|
||||
["COPY (SELECT '--') TO PROGRAM 'sh'"],
|
||||
|
||||
Reference in New Issue
Block a user