Use explicit schema in format calls in DO blocks

michelp / pgsodium

Modern cryptography for PostgreSQL using libsodium.

Other

555 stars 32 forks source link

Use explicit schema in format calls in DO blocks #112

Open svenklemm opened 3 months ago

svenklemm commented 3 months ago

The DO blocks in the version update scripts did not sufficiently lock down search_path for the format calls allowing injection of a malicious format function to be executed during upgrades.