Skip to content
This repository has been archived by the owner on Nov 14, 2020. It is now read-only.

Commit

Permalink
postgresql_role: add input validation for commas in search_path
Browse files Browse the repository at this point in the history
Since we split Postgres' output on commas (specifically, ", "), input values for
the search path may not contain this substring. This is legal in Postgres,
however, so we need to check for it.
  • Loading branch information
Jente Hidskes committed Sep 28, 2019
1 parent 665af96 commit 87d8ca6
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 1 deletion.
3 changes: 3 additions & 0 deletions postgresql/resource_postgresql_role.go
Original file line number Diff line number Diff line change
Expand Up @@ -862,6 +862,9 @@ func alterSearchPath(txn *sql.Tx, d *schema.ResourceData) error {
if len(searchPathInterface) > 0 {
searchPathString = make([]string, len(searchPathInterface))
for i, searchPathPart := range searchPathInterface {
if strings.Contains(searchPathPart.(string), ", ") {
return fmt.Errorf("search_path cannot contain `, `: %v", searchPathPart)
}
searchPathString[i] = pq.QuoteIdentifier(searchPathPart.(string))
}
} else {
Expand Down
4 changes: 3 additions & 1 deletion website/docs/r/postgresql_role.html.markdown
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,9 @@ resource "postgresql_role" "my_replication_role" {

* `roles` - (Optional) Defines list of roles which will be granted to this new role.

* `search_path` - (Optional) Alters the search path of this new role.
* `search_path` - (Optional) Alters the search path of this new role. Note that
due to limitations in the implementation, values cannot contain the substring
`"", ""`.

* `valid_until` - (Optional) Defines the date and time after which the role's
password is no longer valid. Established connections past this `valid_time`
Expand Down

0 comments on commit 87d8ca6

Please sign in to comment.