GHSA-j88v-2chj-qfwx
pgx: SQL Injection via placeholder confusion with dollar quoted string literals
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/jackc/pgx/v5 | < 5.9.2 | 5.9.2 |
| Go | github.com/jackc/pgx/v4 | <= 4.18.3 | no fix listed |
| Go | github.com/jackc/pgx | <= 3.6.2 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
SQL Injection can occur when:
1. The non-default simple protocol is used.
2. A dollar quoted string literal is used in the SQL query.
3. That string literal contains text that would be would be interpreted as a placeholder outside of a string literal.
4. The value of that placeholder is controllable by the attacker.
e.g.
```go
attackValue := `$tag$; drop table canary; --`
_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue)
```
This is unlikely to occur outside of a contrived scenario.
### Patches
The problem is resolved in v5.9.2.
### Workarounds
Do not use the simple protocol to execute queries matching all the above conditions.
References
External links from the advisory. They lead to third-party sites.