Search Postgresql Archives

Re: lower() and unaccent() not leakproof

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



> On 26 Aug 2021, at 16:59, Peter Eisentraut <peter.eisentraut@xxxxxxxxxxxxxxxx> wrote:
> On 26.08.21 10:40, Daniel Gustafsson wrote:

>> Wouldn’t the difference in possible error messages in upper/lower be able to
>> leak whether the input is ascii or wide chars, and/or the collation?
> 
> Yeah, but there aren't any error messages that relate to the argument string, if you look through the code.  There isn't any "could not find lower case equivalent of %s" or anything like that.

Correct.  My reading of "It reveals no information about its arguments other
than by its return value” was that errormessages indicating different code-
paths based on argument structure weren't allowed. That might have been a bit
too lawyery interpretation though.

--
Daniel Gustafsson		https://vmware.com/







[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Postgresql Jobs]     [Postgresql Admin]     [Postgresql Performance]     [Linux Clusters]     [PHP Home]     [PHP on Windows]     [Kernel Newbies]     [PHP Classes]     [PHP Databases]     [Postgresql & PHP]     [Yosemite]

  Powered by Linux