|
Repo Added
|
Files
21
|
Badge
README BADGES
|
push
github
Bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 (#122) Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.9.1 to 5.9.2. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jackc/pgx/blob/master/CHANGELOG.md">github.com/jackc/pgx/v5's changelog</a>.</em></p> <blockquote> <h1>5.9.2 (April 18, 2026)</h1> <p>Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx)</p> <p>SQL injection can occur when:</p> <ol> <li>The non-default simple protocol is used.</li> <li>A dollar quoted string literal is used in the SQL query.</li> <li>That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.</li> <li>The value of that placeholder is controllable by the attacker.</li> </ol> <p>e.g.</p> <pre lang="go"><code>attackValue := `$tag$; drop table canary; --` _, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue) </code></pre> <p>This is unlikely to occur outside of a contrived scenario.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jackc/pgx/commit/0aeabbcf1"><code>0aeabbc</code></a> Release v5.9.2</li> <li><a href="https://github.com/jackc/pgx/commit/60644f849"><code>60644f8</code></a> Fix SQL sanitizer bugs with dollar-quoted strings and placeholder overflow</li> <li><a href="https://github.com/jackc/pgx/commit/a5680bc94"><code>a5680bc</code></a> Merge pull request <a href="https://redirect.github.com/jackc/pgx/issues/2531">#2531</a> from dolmen-go/godoc-add-links</li> <li><a href="https://github.com/jackc/pgx/commit/e34e45240"><code>e34e452</code></a> doc: Add godoc links</li> <li><a href="https://github.com/jackc/pgx/commit/08c9bb1f0"><code>08c9bb1</code></a> Fix St... (continued)
687 of 1896 relevant lines covered (36.23%)
0.39 hits per line
| Coverage | ∆ | File | Lines | Relevant | Covered | Missed | Hits/Line |
|---|