Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

f_unaccent single quote fullText tsquery sql injection

Description

f_unaccent converts these other single quotes into the regular single quote:
<code>
'
ʼn
'
‛
′
＇
<code>
This causes sql injection errors in the full text tsquery, see https://folio-org.atlassian.net/browse/BF-163#icft=BF-163 for an example.

CSP Request Details

None

CSP Rejection Details

None

Potential Workaround

None

Checklist

hide

TestRail: Results

Activity

Show:
Done

Details

Assignee

Reporter

Labels

Priority

Story Points

Sprint

Development Team

Core: Platform

Fix versions

TestRail: Cases

Open TestRail: Cases

TestRail: Runs

Open TestRail: Runs
Created December 16, 2019 at 1:25 PM
Updated January 3, 2020 at 5:39 PM
Resolved December 18, 2019 at 10:49 AM
TestRail: Cases
TestRail: Runs

Flag notifications