michelp / pgsodium

Modern cryptography for PostgreSQL using libsodium.
Other
555 stars 32 forks source link

SQL Injection vulnerability in SECURITY DEFINER function pgsodium.mask_role #116

Open svenklemm opened 1 month ago

svenklemm commented 1 month ago

pgsodium.mask_role does not properly quote the view_name argument before using it in a generated sql query. This is especially critical since mask_role is a security definer function.

There might be similar missing quoting in other non-security definer functions.

Fixed by #115