From 5547e2c559fa652eb7c93ab1b5b589c7b9d550a8 Mon Sep 17 00:00:00 2001
From: Philip Hazel <ph10@hermes.cam.ac.uk>
Date: Fri, 30 Jun 2006 13:57:46 +0000
Subject: [PATCH] Change ${quote_pgsql to quote ' as '' instead of \' because
 of a security issue.

---
 doc/doc-txt/ChangeLog             |  7 ++++++-
 src/src/lookups/pgsql.c           | 19 +++++++++++++++++--
 test/scripts/9200-PostgreSQL/9200 |  1 +
 test/stderr/9200                  | 13 ++++++++++++-
 test/stdout/9200                  |  1 +
 5 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 348c279a1..ea9472d2b 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -1,4 +1,4 @@
-$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.363 2006/06/28 16:00:23 ph10 Exp $
+$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.364 2006/06/30 13:57:46 ph10 Exp $
 
 Change log file for Exim from version 4.21
 -------------------------------------------
@@ -56,6 +56,11 @@ PH/06 Added acl_not_smtp_start, based on Johannes Berg's patch, and set the
       bit to forbid control=suppress_local_fixups in the acl_not_smtp ACL,
       because it is too late at that time, and has no effect.
 
+PH/07 Changed ${quote_pgsql to quote ' as '' instead of \' because of a
+      security issue with \' (bugzilla #107). I could not use the
+      PQescapeStringConn() function, because it needs a PGconn value as one of
+      its arguments.
+
 
 Exim version 4.62
 -----------------
diff --git a/src/src/lookups/pgsql.c b/src/src/lookups/pgsql.c
index 207422c6d..caefeef18 100644
--- a/src/src/lookups/pgsql.c
+++ b/src/src/lookups/pgsql.c
@@ -1,4 +1,4 @@
-/* $Cambridge: exim/src/src/lookups/pgsql.c,v 1.4 2006/02/07 11:19:01 ph10 Exp $ */
+/* $Cambridge: exim/src/src/lookups/pgsql.c,v 1.5 2006/06/30 13:57:46 ph10 Exp $ */
 
 /*************************************************
 *     Exim - an Internet mail transport agent    *
@@ -422,6 +422,16 @@ to allow escaping "on spec". If you use something like "where id="ab\%cd" it
 does treat the string as "ab%cd". So we can safely quote percent and
 underscore. [This is different to MySQL, where you can't do this.]
 
+The original code quoted single quotes as \' which is documented as valid in
+the O'Reilly book "Practical PostgreSQL" (first edition) as an alternative to
+the SQL standard '' way of representing a single quote as data. However, in
+June 2006 there was some security issue with using \' and so this has been
+changed.
+
+[Note: There is a function called PQescapeStringConn() that quotes strings.
+This cannot be used because it needs a PGconn argument (the connection handle).
+Why, I don't know. Seems odd for just string escaping...]
+
 Arguments:
   s          the string to be quoted
   opt        additional option text or NULL if none
@@ -447,7 +457,12 @@ t = quoted = store_get(Ustrlen(s) + count + 1);
 
 while ((c = *s++) != 0)
   {
-  if (Ustrchr("\n\t\r\b\'\"\\%_", c) != NULL)
+  if (c == '\'')
+    {
+    *t++ = '\'';
+    *t++ = '\'';
+    }
+  else if (Ustrchr("\n\t\r\b\"\\%_", c) != NULL)
     {
     *t++ = '\\';
     switch(c)
diff --git a/test/scripts/9200-PostgreSQL/9200 b/test/scripts/9200-PostgreSQL/9200
index 2fd81f5e4..c4440a89e 100644
--- a/test/scripts/9200-PostgreSQL/9200
+++ b/test/scripts/9200-PostgreSQL/9200
@@ -9,6 +9,7 @@ ${lookup pgsql {delete from them where id='nonexist';}}
 ${lookup pgsql {select * from them where id='quote2';}}
 ${lookup pgsql {select * from them where id='newline';}}
 ${lookup pgsql {select * from them where id='tab';}}
+${lookup pgsql {select * from them where name='${quote_pgsql:'stquot}';}}
 ****
 exim -d -bh 10.0.0.0
 mail from:<a@b>
diff --git a/test/stderr/9200 b/test/stderr/9200
index 1a004b30f..593ec4d9c 100644
--- a/test/stderr/9200
+++ b/test/stderr/9200
@@ -100,7 +100,18 @@ internal_search_find: file="NULL"
 database lookup required for select * from them where id='tab';
 PGSQL query: select * from them where id='tab';
 PGSQL using cached connection for localhost/test/CALLER
-lookup yielded: name="x x" id=tab 
+lookup yielded: name="x	x" id=tab 
+search_open: pgsql "NULL"
+  cached open
+search_find: file="NULL"
+  key="select * from them where name='''stquot';" partial=-1 affix=NULL starflags=0
+LRU list:
+internal_search_find: file="NULL"
+  type=pgsql key="select * from them where name='''stquot';"
+database lookup required for select * from them where name='''stquot';
+PGSQL query: select * from them where name='''stquot';
+PGSQL using cached connection for localhost/test/CALLER
+lookup yielded: name='stquot id=quote1 
 search_tidyup called
 close PGSQL connection: localhost/test/CALLER
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
diff --git a/test/stdout/9200 b/test/stdout/9200
index 833f670ce..4b97f9f71 100644
--- a/test/stdout/9200
+++ b/test/stdout/9200
@@ -8,6 +8,7 @@
 > name="before
 after" id=newline 
 > name="x	x" id=tab 
+> name='stquot id=quote1 
 > 
 
 **** SMTP testing session as if from host 10.0.0.0
-- 
2.30.2