13 Commits

Author SHA1 Message Date
Jack Christensen
69fcb46333 Use spaces instead of parentheses for SQL sanitization.
This still solves the problem of negative numbers creating a line
comment, but this avoids breaking edge cases such as `set foo to $1`
where the substition is taking place in a location where an arbitrary
expression is not allowed.
2024-03-09 12:14:44 -06:00
Jack Christensen
0bf9ac391c Fix erroneous test case
The sanitizer does not rewrite the query portions of the query only the
parameters.
2024-03-04 08:49:13 -06:00
Jack Christensen
f94eb0e2f9 Always wrap arguments in parentheses in the SQL sanitizer 2024-03-04 08:47:10 -06:00
Jack Christensen
826a89229b Fix SQL injection via line comment creation in simple protocol 2024-03-04 08:47:10 -06:00
Jack Christensen
3edc1b5bb7 Fix query sanitizer
...when query text has contains Unicode replacement character.
uft8.RuneError actually is a valid character.
2022-11-14 18:30:42 -06:00
Andrew Rusakow
a86ece025c Fix single line comment for line endings in mac when sanitizing. 2022-03-04 18:17:40 -06:00
Jack Christensen
a49f4bb135 Use errors instead of golang.org/x/xerrors 2021-03-25 09:55:12 -04:00
Rusakow Andrew
292539a590 Add comment support when sanitizing SQL queries 2021-03-13 07:31:56 -06:00
Andrew Nicoll
816e95d3ee sanatize time to within microsecond accuracy 2020-03-27 13:03:36 +00:00
Jack Christensen
29f02807b0 Restore simple protocol support 2019-05-20 20:36:03 -05:00
Jack Christensen
c53c9e6eb5 Remove simple protocol and one round trip query options
It is impossible to guarantee that the a query executed with the simple
protocol will behave the same as with the extended protocol. This is
because the normal pgx path relies on knowing the OID of query
parameters. Without this encoding a value can only be determined by the
value instead of the combination of value and PostgreSQL type. For
example, how should a []int32 be encoded? It might be encoded into a
PostgreSQL int4[] or json.

Removal also simplifies the core query path.

The primary reason for the simple protocol is for servers like PgBouncer
that may not be able to support normal prepared statements. After
further research it appears that issuing a "flush" instead "sync" after
preparing the unnamed statement would allow PgBouncer to work.

The one round trip mode can be better handled with prepared statements.

As a last resort, all original server functionality can still be accessed by
dropping down to PgConn.
2019-04-13 11:39:01 -05:00
Jack Christensen
8f4178b3d3 Use github.com/pkg/errors 2017-06-04 21:30:03 -05:00
Jack Christensen
7b1f461ec3 Add simple protocol suuport with (Query|Exec)Ex 2017-04-10 08:58:51 -05:00