Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request 2ndQuadrant#2 from 3nids/schemasafe
`text || regclass`, via the `regclass` to `text` cast, already quotes table identifiers where necessary. The `quote_ident` calls here are unnecessary, and in fact incorrect as they result in quotes that were part of the table quoting becoming part of the identifier name. Example: ``` create table "I will hack your');DROP TABLE student;--" ( haha integer ); SELECT '"I will hack your'');DROP TABLE student;--"'::regclass::oid; -- Produces oid 53060 here regress=> SELECT 'DROP TABLE ' || 53060::oid::regclass; ?column? ------------------------------------ DROP TABLE "I will + hack your');DROP TABLE student;--" (1 row) regress=> SELECT 'DROP TABLE ' || quote_ident(53060::oid::regclass::text); ?column? -------------------------------------- DROP TABLE """I will + hack your');DROP TABLE student;--""" (1 row) ```
- Loading branch information