Re: Patch applied for SQL Injection vulnerability for setObject(int,Object,int)

I have commited a change that completely removes the ability to pass 
anything other than a numeric value when using the setObject() calls for 
types that claim to be numeric.  As Dmitry has pointed out any desire to 
maintain the support for allowing "where ... in (?)" and being able to 
pass a list of values for that single bind variable if flawed.  So the 
latest patch completely closes the sql injection vulnerability by 
preventing this not standard behavior.

thanks,
--Barry

Dmitry Tkach wrote:
> 
> Ok... What about:
> select * from users where id in ?
> setObject (1, "(select setval ('users_id_seq', 1)"); //to screw up the 
> PK sequence
> 
> or...
> 
> setObject (1, "(1) or true"); //to get a list of all the users and 
> passwords
> 
> or...
> 
> setObject (1, "(1) union all select * from secret_table");
>