TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Two Active Record SQL Injection Vulnerabilities Affecting PostgreSQL

43 pointsby elektronautalmost 11 years ago

5 comments

Pacabelalmost 11 years ago
It&#x27;s unfortunate that the wording of the email subject (and the current HN submission title) can make it sound like the problem is with PostgreSQL, when it&#x27;s really a problem with Active Record&#x27;s adapter for PostgreSQL.<p>PostgreSQL itself isn&#x27;t responsible or affected, contrary to what the &quot;Vulnerabilities Affecting PostgreSQL&quot; phrasing suggests at a glance.
bensedatalmost 11 years ago
Looks like the Rails 3.2 update drags along a few other unrelated changes, although they appear to be fairly minor: <a href="https://github.com/rails/rails/compare/v3.2.18...v3.2.19" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;rails&#x2F;rails&#x2F;compare&#x2F;v3.2.18...v3.2.19</a><p>as compared to: <a href="https://github.com/rails/rails/compare/v4.1.2...v4.1.3" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;rails&#x2F;rails&#x2F;compare&#x2F;v4.1.2...v4.1.3</a> and <a href="https://github.com/rails/rails/compare/v4.0.6...v4.0.7" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;rails&#x2F;rails&#x2F;compare&#x2F;v4.0.6...v4.0.7</a>
评论 #7979301 未加载
评论 #7979299 未加载
评论 #7978925 未加载
craigkerstiensalmost 11 years ago
You should be able to see if you are vulnerable by running this query:<p><pre><code> select cn.nspname as schema, relname as table, attname as column, tn.nspname as type_schema, typname as type_name from pg_attribute a inner join pg_class c on a.attrelid = c.oid inner join pg_namespace cn on c.relnamespace = cn.oid inner join pg_type t on a.atttypid = t.oid inner join pg_namespace tn on t.typnamespace = tn.oid where (t.typtype = &#x27;r&#x27; or t.typname = &#x27;bit&#x27; or t.typname = &#x27;varbit&#x27;);</code></pre>
bnialmost 11 years ago
So Active Record is building its SQL from string concatenation, not using prepared statements with bind variables?
评论 #7978658 未加载
评论 #7978499 未加载
评论 #7978482 未加载
jrmiiialmost 11 years ago
FTA: Only applications which query against either bitstring or range types are vulnerable.