93 lines
3.5 KiB
Diff
93 lines
3.5 KiB
Diff
Fix CVE-2022-31197
|
|
|
|
Source of this commit and more information about it is here:
|
|
https://github.com/pgjdbc/pgjdbc/commit/739e599d52ad80f8dcd6efedc6157859b1a9d637
|
|
|
|
diff --git a/src/main/java/org/postgresql/jdbc/PgResultSet.java b/src/main/java/org/postgresql/jdbc/PgResultSet.java
|
|
index 42c6dda6..81a5ef1d 100644
|
|
--- a/src/main/java/org/postgresql/jdbc/PgResultSet.java
|
|
+++ b/src/main/java/org/postgresql/jdbc/PgResultSet.java
|
|
@@ -1323,7 +1323,7 @@ public class PgResultSet implements ResultSet, org.postgresql.PGRefCursorResultS
|
|
if (i > 1) {
|
|
selectSQL.append(", ");
|
|
}
|
|
- selectSQL.append(pgmd.getBaseColumnName(i));
|
|
+ Utils.escapeIdentifier(selectSQL, pgmd.getBaseColumnName(i));
|
|
}
|
|
selectSQL.append(" from ").append(onlyTable).append(tableName).append(" where ");
|
|
|
|
@@ -1333,7 +1333,8 @@ public class PgResultSet implements ResultSet, org.postgresql.PGRefCursorResultS
|
|
for (int i = 0; i < numKeys; i++) {
|
|
|
|
PrimaryKey primaryKey = primaryKeys.get(i);
|
|
- selectSQL.append(primaryKey.name).append("= ?");
|
|
+ Utils.escapeIdentifier(selectSQL, primaryKey.name);
|
|
+ selectSQL.append(" = ?");
|
|
|
|
if (i < numKeys - 1) {
|
|
selectSQL.append(" and ");
|
|
|
|
diff --git a/pgjdbc/src/test/java/org/postgresql/test/jdbc2/ResultSetRefreshTest.java b/pgjdbc/src/test/java/org/postgresql/test/jdbc2/ResultSetRefreshTest.java
|
|
new file mode 100644
|
|
index 00000000..3a4a7e51
|
|
--- /dev/null
|
|
+++ b/src/test/java/org/postgresql/test/jdbc2/ResultSetRefreshTest.java
|
|
@@ -0,0 +1,57 @@
|
|
+/*
|
|
+ * Copyright (c) 2022, PostgreSQL Global Development Group
|
|
+ * See the LICENSE file in the project root for more information.
|
|
+ */
|
|
+
|
|
+package org.postgresql.test.jdbc2;
|
|
+
|
|
+import static org.junit.Assert.assertTrue;
|
|
+
|
|
+import org.postgresql.test.TestUtil;
|
|
+
|
|
+import org.junit.Test;
|
|
+
|
|
+import java.sql.ResultSet;
|
|
+import java.sql.SQLException;
|
|
+import java.sql.Statement;
|
|
+import java.sql.Connection;
|
|
+
|
|
+public class ResultSetRefreshTest extends BaseTest4 {
|
|
+ @Test
|
|
+ public void testWithDataColumnThatRequiresEscaping() throws Exception {
|
|
+ Connection conn = con;
|
|
+ TestUtil.dropTable(conn, "refresh_row_bad_ident");
|
|
+ TestUtil.execute("CREATE TABLE refresh_row_bad_ident (id int PRIMARY KEY, \"1 FROM refresh_row_bad_ident; SELECT 2; SELECT *\" int)",conn);
|
|
+ TestUtil.execute("INSERT INTO refresh_row_bad_ident (id) VALUES (1), (2), (3)",conn);
|
|
+
|
|
+ Statement stmt = conn.createStatement(ResultSet.TYPE_FORWARD_ONLY, ResultSet.CONCUR_UPDATABLE);
|
|
+ ResultSet rs = stmt.executeQuery("SELECT * FROM refresh_row_bad_ident");
|
|
+ assertTrue(rs.next());
|
|
+ try {
|
|
+ rs.refreshRow();
|
|
+ } catch (SQLException ex) {
|
|
+ throw new RuntimeException("ResultSet.refreshRow() did not handle escaping data column identifiers", ex);
|
|
+ }
|
|
+ rs.close();
|
|
+ stmt.close();
|
|
+ }
|
|
+
|
|
+ @Test
|
|
+ public void testWithKeyColumnThatRequiresEscaping() throws Exception {
|
|
+ Connection conn = con;
|
|
+ TestUtil.dropTable(conn, "refresh_row_bad_ident");
|
|
+ TestUtil.execute("CREATE TABLE refresh_row_bad_ident (\"my key\" int PRIMARY KEY)",conn);
|
|
+ TestUtil.execute("INSERT INTO refresh_row_bad_ident VALUES (1), (2), (3)",conn);
|
|
+
|
|
+ Statement stmt = conn.createStatement(ResultSet.TYPE_FORWARD_ONLY, ResultSet.CONCUR_UPDATABLE);
|
|
+ ResultSet rs = stmt.executeQuery("SELECT * FROM refresh_row_bad_ident");
|
|
+ assertTrue(rs.next());
|
|
+ try {
|
|
+ rs.refreshRow();
|
|
+ } catch (SQLException ex) {
|
|
+ throw new RuntimeException("ResultSet.refreshRow() did not handle escaping key column identifiers", ex);
|
|
+ }
|
|
+ rs.close();
|
|
+ stmt.close();
|
|
+ }
|
|
+}
|