pgadmin-org / pgadmin4

pgAdmin is the most popular and feature rich Open Source administration and development platform for PostgreSQL, the most advanced Open Source database in the world.
https://www.pgadmin.org
Other
2.55k stars 659 forks source link

possibly bugous _% pattern usage in namespace and typname checks #8162

Open asoki opened 4 days ago

asoki commented 4 days ago

By chance I saw the following repeating code used in the where part of various queries: nspname LIKE '_%' typname not like '_%' typname like '_%'

If I interpret that correctly, the intention was to recognize strings that start with underscore. In this case, shouldn't the underscore be escaped like '\_%' ?

for example: https://github.com/pgadmin-org/pgadmin4/blob/ec197c68b8d092364e8bd7e84da566bbcbcd349a/web/pgadmin/browser/server_groups/servers/databases/schemas/collations/templates/collations/sql/default/backend_support.sql#L12 https://github.com/pgadmin-org/pgadmin4/blob/ec197c68b8d092364e8bd7e84da566bbcbcd349a/web/pgadmin/browser/server_groups/servers/databases/schemas/foreign_tables/templates/foreign_tables/sql/default/types_condition.sql#L7 https://github.com/pgadmin-org/pgadmin4/blob/ec197c68b8d092364e8bd7e84da566bbcbcd349a/web/pgadmin/browser/server_groups/servers/databases/schemas/sequences/templates/sequences/sql/default/backend_support.sql#L11 https://github.com/pgadmin-org/pgadmin4/blob/ec197c68b8d092364e8bd7e84da566bbcbcd349a/web/pgadmin/browser/server_groups/servers/databases/schemas/domains/__init__.py#L545 https://github.com/pgadmin-org/pgadmin4/blob/ec197c68b8d092364e8bd7e84da566bbcbcd349a/web/pgadmin/browser/server_groups/servers/databases/schemas/types/templates/types/pg/sql/default/get_types.sql#L9 https://github.com/pgadmin-org/pgadmin4/blob/ec197c68b8d092364e8bd7e84da566bbcbcd349a/web/pgadmin/browser/server_groups/servers/databases/schemas/types/templates/types/ppas/sql/default/get_types.sql#L9 https://github.com/pgadmin-org/pgadmin4/blob/ec197c68b8d092364e8bd7e84da566bbcbcd349a/web/pgadmin/browser/server_groups/servers/databases/schemas/tables/templates/columns/sql/default/get_types.sql#L11 https://github.com/pgadmin-org/pgadmin4/blob/ec197c68b8d092364e8bd7e84da566bbcbcd349a/web/pgadmin/browser/server_groups/servers/databases/schemas/tables/templates/exclusion_constraint/sql/default/get_operator.sql#L17 https://github.com/pgadmin-org/pgadmin4/blob/ec197c68b8d092364e8bd7e84da566bbcbcd349a/web/pgadmin/browser/server_groups/servers/databases/schemas/tables/templates/tables/sql/default/backend_support.sql#L12 https://github.com/pgadmin-org/pgadmin4/blob/ec197c68b8d092364e8bd7e84da566bbcbcd349a/web/pgadmin/browser/server_groups/servers/databases/schemas/tables/templates/tables/sql/default/get_types_where_condition.sql#L5 https://github.com/pgadmin-org/pgadmin4/blob/ec197c68b8d092364e8bd7e84da566bbcbcd349a/web/pgadmin/browser/server_groups/servers/databases/casts/templates/casts/sql/default/getsrcandtrgttype.sql#L32

test: select 1, 'a' like '_%'; -- 1, true select 2, 'a' like '_%'; -- 2, true select 3, 'a' like '\\%'; -- 3, false select 4, 'a' like '\\%'; -- 4, true

Thanks for checking

khushboovashi commented 3 days ago

Hi @asoki,

Percent sign ( %) matches any sequence of zero or more characters. Underscore sign (_) matches any single character.

So, your assumption here is not correct.

asoki commented 3 days ago

Hi @khushboovashi

thank you for your reply. yes it works exactly as you explained.

I haven't checked the surrounding code, but for example, what is the purpose of this where condition part: typname NOT LIKE '_%'

typname NOT LIKE any single character followed by zero or more characters? isn't that just empty? or should this condition be written with an escaped underscore, as typname NOT LIKE '\_%' so the condition would become typname NOT LIKE underscore followed by zero or more characters.

i have not checked the function of the code in question, it is quite possible that i am wrong and the code is correct.