Re: copy_from doesn't handle specifying null character properly

Il giorno ven, 18/07/2008 alle 17.14 +1000, Alejandro Dubrovsky ha
scritto:
> Hi all,
> 
> I'll make it short:
> 
> cursor.copy_from(somefile, 'sometable')
> works in cases where
> cursor.copy_from(somefile, 'sometable', null='\\N')
> doesn't.  This is in bzr trunk (or whatever head is called in bzr)
> 
> 
> It does work with the following:
> 
> cursor.copy_from(somefile, 'sometable', null=r'\\N')
> or 
> cursor.copy_from(somefile, 'sometable', null='\\\\N')
> 
> 
> psycopg2 sends the following to postgres (from the debug output):
> 
>  ...testsimple FROM stdin USING DELIMITERS ' ' WITH NULL AS '\N'
> 
> which postgres sort of interprets as N (eating the escape).  psycopg2
> should escape the string before sending it to postgres.
> 
> In some possible configurations, this could be a security hole.  If
> input from the user is passed to psycopg2 as the null parameter in the
> very reasonable assumption that psycopg2 should escape those values,
> something like null="'; <malicious code> where '' = '" would likely get

Yes, psycopg should quote that data. I'llfix this problem ASAP.

federico

-- 
Federico Di Gregorio                         http://people.initd.org/fog
Debian GNU/Linux Developer                                [email protected]
INIT.D Developer                                           fog-NGVKUo/i/[email protected]
 If we are going to teach "creation science" as an alternative to
  evolution, then we should also teach the stork theory as an
  alternative to biological reproduction.                -- Judith Hayes

_______________________________________________
Psycopg mailing list
Psycopg-IAPFreCvJWPBWskQ1e/[email protected]
http://lists.initd.org/mailman/listinfo/psycopg

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEABECAAYFAkiB548ACgkQvcCgrgZGjesrnwCgncUToJ8PhX7QjwyfofTnFYtW
xBsAn35Ucrp2YL5xcl/3pdpi1ddL48EY
=mTdt
-----END PGP SIGNATURE-----