mmkal / pgkit

PostgreSQL🤝TypeScript monorepo. SQL client/admin UI/smart migrator/type generator/schema inspector
https://pgkit.dev
190 stars 25 forks source link

fix(typegen): don't let semicolons cause queries to be executed #387

Closed mmkal closed 2 years ago

mmkal commented 2 years ago

It was possible to make psql accidentally execute statements if they ended with a semicolon. The problem:

echo 'create table foo1(id int); \gdesc' | psql -f -

Actually executes create table foo(id int) and ignores the \gdesc part as an invalid command. This works around by banning semicolons altogether unless they're the last character, in which case they'll be trimmed. Parsing the query would probably be better but it's harder to be sure it's safe that way.

janpaepke commented 2 years ago

Woah! Good find!