Don't pass strings directly to errdetail() and errhint() - use

mhagander · mhagander · commit 6c3690d835e3 · 2008-11-20T15:36:22.000Z
%s to unescape them. Fixes a potential security issue (in as yet
unreleased code)
diff --git a/src/pl/plpgsql/src/pl_exec.c b/src/pl/plpgsql/src/pl_exec.c
@@ -8,7 +8,7 @@
  *
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/pl/plpgsql/src/pl_exec.c,v 1.224 2008/11/05 00:07:54 tgl Exp $
+ *	  $PostgreSQL: pgsql/src/pl/plpgsql/src/pl_exec.c,v 1.225 2008/11/20 15:36:22 mha Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -2538,8 +2538,8 @@ exec_stmt_raise(PLpgSQL_execstate *estate, PLpgSQL_stmt_raise *stmt)
 	ereport(stmt->elog_level,
 			(err_code ? errcode(err_code) : 0,
 			 errmsg_internal("%s", err_message),
-			 (err_detail != NULL) ? errdetail(err_detail) : 0,
-			 (err_hint != NULL) ? errhint(err_hint) : 0));
+			 (err_detail != NULL) ? errdetail("%s", err_detail) : 0,
+			 (err_hint != NULL) ? errhint("%s", err_hint) : 0));
 
 	estate->err_text = NULL;	/* un-suppress... */
 

Original file line number	Diff line number	Diff line change
`@@ -8,7 +8,7 @@`
`8`	`8`	`*`
`9`	`9`	`*`
`10`	`10`	`* IDENTIFICATION`
`11`		`- * $PostgreSQL: pgsql/src/pl/plpgsql/src/pl_exec.c,v 1.224 2008/11/05 00:07:54 tgl Exp $`
	`11`	`+ * $PostgreSQL: pgsql/src/pl/plpgsql/src/pl_exec.c,v 1.225 2008/11/20 15:36:22 mha Exp $`
`12`	`12`	`*`
`13`	`13`	`*-------------------------------------------------------------------------`
`14`	`14`	`*/`
`@@ -2538,8 +2538,8 @@ exec_stmt_raise(PLpgSQL_execstate estate, PLpgSQL_stmt_raise stmt)`
`2538`	`2538`	`ereport(stmt->elog_level,`
`2539`	`2539`	`(err_code ? errcode(err_code) : 0,`
`2540`	`2540`	`errmsg_internal("%s", err_message),`
`2541`		`- (err_detail != NULL) ? errdetail(err_detail) : 0,`
`2542`		`- (err_hint != NULL) ? errhint(err_hint) : 0));`
	`2541`	`+ (err_detail != NULL) ? errdetail("%s", err_detail) : 0,`
	`2542`	`+ (err_hint != NULL) ? errhint("%s", err_hint) : 0));`
`2543`	`2543`
`2544`	`2544`	`estate->err_text = NULL; /* un-suppress... */`
`2545`	`2545`