Ensembia/occweb
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Block all dblink functions in the SQL mode

Browse Source 
Only dblink() and dblink_connect() were blocked, so dblink_exec(),
dblink_send_query() and the other functions of the extension could
still reach other databases. Match every function whose name starts
with dblink.
This commit is contained in:
Dillard Blom
2026-09-30 16:48:50 +02:00
parent 284e75ddb3
commit d7b093812d
2 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/Service/SqlGuard.php
+1 -1
View File
@@ -27,7 +27,7 @@ class SqlGuard
'/\bpg_stat_file\s*\(/i' => 'pg_stat_file()', '/\bpg_stat_file\s*\(/i' => 'pg_stat_file()',
'/\blo_import\s*\(/i' => 'lo_import()', '/\blo_import\s*\(/i' => 'lo_import()',
'/\blo_export\s*\(/i' => 'lo_export()', '/\blo_export\s*\(/i' => 'lo_export()',
'/\bdblink(_connect)?\s*\(/i' => 'dblink() (connects to arbitrary databases)', '/\bdblink\w*\s*\(/i' => 'dblink functions (connect to arbitrary databases)',
'/\bLOAD_FILE\s*\(/i' => 'LOAD_FILE()', '/\bLOAD_FILE\s*\(/i' => 'LOAD_FILE()',
'/\bINTO\s+(OUTFILE|DUMPFILE)\b/i' => 'INTO OUTFILE/DUMPFILE', '/\bINTO\s+(OUTFILE|DUMPFILE)\b/i' => 'INTO OUTFILE/DUMPFILE',
]; ];
tests/Unit/Service/SqlGuardTest.php
+3
View File
@@ -23,6 +23,9 @@ class SqlGuardTest extends TestCase
["SELECT pg_ls_dir('/')"], ["SELECT pg_ls_dir('/')"],
["SELECT lo_import('/etc/passwd')"], ["SELECT lo_import('/etc/passwd')"],
["SELECT dblink_connect('host=x')"], ["SELECT dblink_connect('host=x')"],
["SELECT dblink_exec('host=x', 'DROP TABLE t')"],
["SELECT dblink_send_query('c', 'SELECT 1')"],
["SELECT * FROM dblink('host=x', 'SELECT 1') AS t(a int)"],
["SELECT * FROM t INTO OUTFILE '/tmp/x'"], ["SELECT * FROM t INTO OUTFILE '/tmp/x'"],
["COPY (SELECT '/*') TO PROGRAM 'sh' --*/"], ["COPY (SELECT '/*') TO PROGRAM 'sh' --*/"],
["COPY (SELECT '--') TO PROGRAM 'sh'"], ["COPY (SELECT '--') TO PROGRAM 'sh'"],