> Your original code calls mongoc_client_new() The _with error() > variant was added two years ago. > How would I find out which mongo-c library version supports the > _with error() variant which gives a better error message? > The on-line documentation is not quite clear about that, it seems > to assume that everyone will be using the latest and greatest.
ah, I see. It was introduced in v1.21.0 with: https://github.com/mongodb/mongo-c-driver/commit/e7e15002d63cb57424f467c5f21eafa9ec0f018e I'm using alpine 3.16 which has v1.16.2 , will upgrade to alpine 3.18 and build with v1.23.4 of the driver. > The "%s" stuff will paste in bits from the Postfix query, which > can be an email address provided by a hostile SMTP client. > A hostile client could use an address that contains quotes or > backslashes, to change the structure of the MongoDB query, > and exercise database features that you did not intend.. > If the idea is that the "user" would escape the quotes etc, > then I wodewr what user you have inb mind. It can't be the > person who configures Postfix or the person who maintains the > database. That is fair, I have failed to consider that scenario. MQL is not prone to SQL Injection type attacks, but escaping would make it more safe. Absolutely. > What code is supposed to pay attention to '$' characters? The Postfix client? > The MongoC library? In MQL, you have operators like "$or", or you can use the value of a field like "$field". These are instances that the person configuring postfix would need to use a $ character in either query or projection. In this example: filter = {"$$or": [{"username":"%s"}, {"alias.address": "%s"}], "active": 1} I am configuring dict_mongo to use an $or operator, and search the collection for any records which has a username or alias.address set to the requested value. Regards Hamid Maadani _______________________________________________ Postfix-devel mailing list -- postfix-devel@postfix.org To unsubscribe send an email to postfix-devel-le...@postfix.org
