From 9b92f115bdf9f21e9a8c4dcd80207c0723e81c3b Mon Sep 17 00:00:00 2001 From: Noah Misch Date: Mon, 11 Aug 2025 06:18:59 -0700 Subject: Convert newlines to spaces in names written in v11+ pg_dump comments. Maliciously-crafted object names could achieve SQL injection during restore. CVE-2012-0868 fixed this class of problem at the time, but later work reintroduced three cases. Commit bc8cd50fefd369b217f80078585c486505aafb62 (back-patched to v11+ in 2023-05 releases) introduced the pg_dump case. Commit 6cbdbd9e8d8f2986fde44f2431ed8d0c8fce7f5d (v12+) introduced the two pg_dumpall cases. Move sanitize_line(), unchanged, to dumputils.c so pg_dumpall has access to it in all supported versions. Back-patch to v13 (all supported versions). Reviewed-by: Robert Haas Reviewed-by: Nathan Bossart Backpatch-through: 13 Security: CVE-2025-8715 --- src/bin/pg_dump/dumputils.h | 1 + 1 file changed, 1 insertion(+) (limited to 'src/bin/pg_dump/dumputils.h') diff --git a/src/bin/pg_dump/dumputils.h b/src/bin/pg_dump/dumputils.h index 98c71c6bf94..d1248d9061b 100644 --- a/src/bin/pg_dump/dumputils.h +++ b/src/bin/pg_dump/dumputils.h @@ -36,6 +36,7 @@ #endif +extern char *sanitize_line(const char *str, bool want_hyphen); extern bool buildACLCommands(const char *name, const char *subname, const char *nspname, const char *type, const char *acls, const char *baseacls, const char *owner, const char *prefix, int remoteVersion, -- cgit v1.2.3