rdelaage/postgresql
1
0
Fork 0
mirror of https://git.postgresql.org/git/postgresql.git synced 2024-07-20 03:29:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Docs: add disclaimer about hazards of using regexps from untrusted sources.

Browse Source 
It's not terribly hard to devise regular expressions that take large
amounts of time and/or memory to process.  Recent testing by Greg Stark has
also shown that machines with small stack limits can be driven to stack
overflow by suitably crafted regexps.  While we intend to fix these things
as much as possible, it's probably impossible to eliminate slow-execution
cases altogether.  In any case we don't want to treat such things as
security issues.  The history of that code should already discourage
prudent DBAs from allowing execution of regexp patterns coming from
possibly-hostile sources, but it seems like a good idea to warn about the
hazard explicitly.

Currently, similar_escape() allows access to enough of the underlying
regexp behavior that the warning has to apply to SIMILAR TO as well.
We might be able to make it safer if we tightened things up to allow only
SQL-mandated capabilities in SIMILAR TO; but that would be a subtly
non-backwards-compatible change, so it requires discussion and probably
could not be back-patched.

Per discussion among pgsql-security list.
This commit is contained in:
Tom Lane 2015-10-02 13:30:42 -04:00
parent 1dc6f557e7
commit c56b2aa6ef
1 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
doc/src/sgml/func.sgml
View File

@ -3600,6 +3600,28 @@ cast(-44 as bit(12)) <lineannotation>111111010100</lineannotation>
</para>
</tip>
<caution>
<para>
While most regular-expression searches can be executed very quickly,
regular expressions can be contrived that take arbitrary amounts of
time and memory to process. Be wary of accepting regular-expression
search patterns from hostile sources. If you must do so, it is
advisable to impose a statement timeout.
</para>
<para>
Searches using <function>SIMILAR TO</function> patterns have the same
security hazards, since <function>SIMILAR TO</function> provides many
of the same capabilities as <acronym>POSIX</acronym>-style regular
expressions.
</para>
<para>
<function>LIKE</function> searches, being much simpler than the other
two options, are safer to use with possibly-hostile pattern sources.
</para>
</caution>
<sect2 id="functions-like">
<title><function>LIKE</function></title>