| From: | "Jonah H(dot) Harris" <jonah(dot)harris(at)gmail(dot)com> |
|---|---|
| To: | Heikki Linnakangas <heikki(dot)linnakangas(at)enterprisedb(dot)com> |
| Cc: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Bruce Momjian <bruce(at)momjian(dot)us>, Alvaro Herrera <alvherre(at)commandprompt(dot)com>, Tomasz Olszak <tolszak(at)o2(dot)pl>, pgsql-hackers(at)postgresql(dot)org |
| Subject: | Re: Problem with accesing Oracle from plperlu functionwhen using remote pg client. |
| Date: | 2009-03-16 21:25:40 |
| Message-ID: | 36e682920903161425p50a78c55raa21e48c24f83049@mail.gmail.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On Mon, Mar 16, 2009 at 5:22 PM, Heikki Linnakangas <
heikki(dot)linnakangas(at)enterprisedb(dot)com> wrote:
> Hmm, I wonder if you could do something malicious with it. Like, run a
> query along the lines of "SELECT $$ (HOST=10.0.0.123) $$, connect()... " to
> divert the connection to another server.
Not any more malicious than a connection string in and of itself. It's
only used as a hierarchical name-value pair string, nothing is executed from
it.
--
Jonah H. Harris, Senior DBA
myYearbook.com
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Robert Haas | 2009-03-16 21:43:23 | Re: small but useful patches for text search |
| Previous Message | Heikki Linnakangas | 2009-03-16 21:22:58 | Re: Problem with accesing Oracle from plperlu functionwhen using remote pg client. |