简体繁体 English

关于改进此 postgres function 创建别名然后将其作为 json 返回的任何提示。将列标题翻译成不同的语言

[英]Any tips on improving this postgres function that creates alias and then returns it as json. To translate column headers to different language

原文 2022-09-27 20:42:37 4 1 json/ postgresql/ function/ sql-injection

Given a table, and then another 'meta data' table that contains the translations.给定一个表，然后是另一个包含翻译的“元数据”表。 The function looks up the translation and then builds an alias statement. function 查找翻译，然后构建别名语句。 Also is it injection safe?注射安全吗？

https://dbfiddle.uk/JQ6AnBVx https://dbfiddle.uk/JQ6AnBVx

1 个解决方案

This has SQL injections in several areas - whether they are exploitable or not will depend on what information can be passed through a trust boundary (passed in be an untrusted user / program).这在几个领域有 SQL 次注入——它们是否可利用将取决于哪些信息可以通过信任边界传递（传递给不受信任的用户/程序）。

For instance in your translate_column function all the parameters (except for the language ID) can be used for SQL injection.例如，在您的translate_column function 中，所有参数（语言 ID 除外）都可用于 SQL 注入。 If any of those can (or in the future may) come from untrusted sources this is vulnerable.如果其中任何一个可以（或将来可能）来自不受信任的来源，那么这很容易受到攻击。

Similarly, if your alias_text or translated_column can be controlled by an untrusted user, the f_get_table_with_alias is vulnerable.同样，如果您的alias_text或translated_column可以由不受信任的用户控制，则f_get_table_with_alias很容易受到攻击。 This includes allowing unvalidated data being inserted into your test tables.这包括允许将未经验证的数据插入到您的测试表中。

There are two options to do this safely - ideally you should use both:有两种方法可以安全地执行此操作——理想情况下，您应该同时使用这两种方法：

When your users create the names used for tables (or any DB objects) you may should limit the names to use a "safe" set of characters (alphanumeric & dashes, underscores...)当您的用户创建用于表（或任何数据库对象）的名称时，您可能应该限制名称使用“安全”字符集（字母数字和破折号，下划线...）
You should enquote the table names / column names - adding double quotes around the objects.您应该引用表名/列名 - 在对象周围添加双引号。 If you do this, you need to be careful to validate there are no quotes in the name, and error out or escape the quotes.如果这样做，您需要小心验证名称中没有引号，并错误或转义引号。 You also need to be aware that adding quotes will make the name case sensitive.您还需要注意，添加引号会使名称区分大小写。