Re: [BUGS] BUG #6162: initdb : Windows username isn't escaped

2012-08-15 Thread Bruce Momjian
On Sun, Aug 14, 2011 at 11:25:22AM +, Emmanuel Guyot wrote:
> 
> The following bug has been logged online:
> 
> Bug reference:  6162
> Logged by:  Emmanuel Guyot
> Email address:  emmanuel.gu...@gmail.com
> PostgreSQL version: 8.2.3
> Operating system:   Windows 7
> Description:initdb : Windows username isn't escaped
> Details: 
> 
> Initdb crashes when I use it with a windows username that has a quote inside
> (e.g. : L'élixir)
> 
> Here is the error reported :
> initialisation des droits sur les objets internes... 2010-05-14 17:01:25.434
> FATAL: syntax error at or near "élixir" at character 44
> 2010-05-14 17:01:25.434 STATEMENT: UPDATE pg_class SET relacl =
> E'{"=r/\\"L'élixir\\""}' WHERE relkind IN ('r', 'v', 'S') AND relacl IS
> NULL;
> 
> If I force the username as an option with the escaped value L\'élixir the
> initdb works fine, but I can't start the server. So I can't find a
> workaround.
> 
> I've watched the newer sources of initdb and I can't see any change for this
> bug.

I have fixed the problem with the attached, applied patch, which will
appear in Postgres 9.3.  The problem was that single-quotes in usernames
were not properly escaped by initdb.

Also, I have improved the pg_hba.conf documentation, and added an assert
to catch future breakage.

-- 
  Bruce Momjian  http://momjian.us
  EnterpriseDB http://enterprisedb.com

  + It's impossible for everything to be true. +
diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml
new file mode 100644
index 679c40a..9771394
*** a/doc/src/sgml/client-auth.sgml
--- b/doc/src/sgml/client-auth.sgml
***
*** 80,86 
 Records cannot be continued across lines.
 A record is made
 up of a number of fields which are separated by spaces and/or tabs.
!Fields can contain white space if the field value is quoted.
 Quoting one of the keywords in a database, user, or address field (e.g.,
 all or replication) makes the word lose its special
 character, and just match a database, user, or host with that name.
--- 80,86 
 Records cannot be continued across lines.
 A record is made
 up of a number of fields which are separated by spaces and/or tabs.
!Fields can contain white space if the field value is double-quoted.
 Quoting one of the keywords in a database, user, or address field (e.g.,
 all or replication) makes the word lose its special
 character, and just match a database, user, or host with that name.
diff --git a/src/backend/parser/scansup.c b/src/backend/parser/scansup.c
new file mode 100644
index 6101457..b8e2f71
*** a/src/backend/parser/scansup.c
--- b/src/backend/parser/scansup.c
*** scanstr(const char *s)
*** 56,61 
--- 56,63 
  			 * appear in pairs, so there should be another character.
  			 */
  			i++;
+ 			/* The bootstrap parser is not as smart, so check here. */
+ 			Assert(s[i] == '\'');
  			newStr[j] = s[i];
  		}
  		else if (s[i] == '\\')
diff --git a/src/bin/initdb/initdb.c b/src/bin/initdb/initdb.c
new file mode 100644
index 132ad0f..a53760a
*** a/src/bin/initdb/initdb.c
--- b/src/bin/initdb/initdb.c
*** bootstrap_template1(void)
*** 1395,1401 
  	bki_lines = replace_token(bki_lines, "FLOAT8PASSBYVAL",
  			  FLOAT8PASSBYVAL ? "true" : "false");
  
! 	bki_lines = replace_token(bki_lines, "POSTGRES", username);
  
  	bki_lines = replace_token(bki_lines, "ENCODING", encodingid);
  
--- 1395,1401 
  	bki_lines = replace_token(bki_lines, "FLOAT8PASSBYVAL",
  			  FLOAT8PASSBYVAL ? "true" : "false");
  
! 	bki_lines = replace_token(bki_lines, "POSTGRES", escape_quotes(username));
  
  	bki_lines = replace_token(bki_lines, "ENCODING", encodingid);
  
*** setup_privileges(void)
*** 2043,2050 
  
  	PG_CMD_OPEN;
  
! 	priv_lines = replace_token(privileges_setup,
! 			   "$POSTGRES_SUPERUSERNAME", username);
  	for (line = priv_lines; *line != NULL; line++)
  		PG_CMD_PUTS(*line);
  
--- 2043,2050 
  
  	PG_CMD_OPEN;
  
! 	priv_lines = replace_token(privileges_setup, "$POSTGRES_SUPERUSERNAME",
! 			   escape_quotes(username));
  	for (line = priv_lines; *line != NULL; line++)
  		PG_CMD_PUTS(*line);
  
*** main(int argc, char *argv[])
*** 3056,3062 
  	canonicalize_path(pg_data);
  
  #ifdef WIN32
- 
  	/*
  	 * Before we execute another program, make sure that we are running with a
  	 * restricted token. If not, re-execute ourselves with one.
--- 3056,3061 

-- 
Sent via pgsql-bugs mailing list (pgsql-bugs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs


[BUGS] BUG #6162: initdb : Windows username isn't escaped

2011-08-14 Thread Emmanuel Guyot

The following bug has been logged online:

Bug reference:  6162
Logged by:  Emmanuel Guyot
Email address:  emmanuel.gu...@gmail.com
PostgreSQL version: 8.2.3
Operating system:   Windows 7
Description:initdb : Windows username isn't escaped
Details: 

Initdb crashes when I use it with a windows username that has a quote inside
(e.g. : L'élixir)

Here is the error reported :
initialisation des droits sur les objets internes... 2010-05-14 17:01:25.434
FATAL: syntax error at or near "élixir" at character 44
2010-05-14 17:01:25.434 STATEMENT: UPDATE pg_class SET relacl =
E'{"=r/\\"L'élixir\\""}' WHERE relkind IN ('r', 'v', 'S') AND relacl IS
NULL;

If I force the username as an option with the escaped value L\'élixir the
initdb works fine, but I can't start the server. So I can't find a
workaround.

I've watched the newer sources of initdb and I can't see any change for this
bug.

-- 
Sent via pgsql-bugs mailing list (pgsql-bugs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs