Should rolpassword be toastable?
От | Alexander Lakhin |
---|---|
Тема | Should rolpassword be toastable? |
Дата | |
Msg-id | 89e8649c-eb74-db25-7945-6d6b23992394@gmail.com обсуждение исходный текст |
Ответы |
Re: Should rolpassword be toastable?
|
Список | pgsql-hackers |
Hello hackers, When playing with oversized tuples, I've found that it's possible to set such oversized password for a user, that could not be validated. For example: SELECT format('CREATE ROLE test_user LOGIN PASSWORD ''SCRAM-SHA-256$' || repeat('0', 2000000) || '4096:NuDacwYSUxeOeFUEf3ivTQ==$Wgvq3OCYrJI6eUfvKlAzn4p/j3mzgWzXbVnWeFK1qhY=:r1qSP0j2QojCjLpFUjI0i6ckInvxJDKoyWnN3zF8WCM='';') \gexec -- the password is "pass" (One can achieve the same result with a large salt size, for example, 2048.) psql -U "test_user" -c "SELECT 1" psql: error: connection to server on socket "/tmp/.s.PGSQL.5432" failed: FATAL: cannot read pg_class without having selected a database I've tried to set attstorage = 'p' for the rolpassword attribute forcefully by dirty hacking genbki.pl, and as a result I get an error on CREATE ROLE: ERROR: row is too big: size 2000256, maximum size 8160 Best regards, Alexander
В списке pgsql-hackers по дате отправления: