Restrict tsearch config file base names to contain a-z, 0-9, and underscore,

instead of the initial policy of whatever isalpha() likes.  Per discussion.

diff --git a/src/backend/tsearch/ts_utils.c b/src/backend/tsearch/ts_utils.c
index e9ad59282a084737bac5815f51c899e869165ec2..781146886a30e0ec5c90f6293ffee22e78226d4d 100644 (file)
--- a/src/backend/tsearch/ts_utils.c
+++ b/src/backend/tsearch/ts_utils.c
@@ -7,7 +7,7 @@
  *
  *
  * IDENTIFICATION
- *       $PostgreSQL: pgsql/src/backend/tsearch/ts_utils.c,v 1.3 2007/08/25 00:03:59 tgl Exp $
+ *       $PostgreSQL: pgsql/src/backend/tsearch/ts_utils.c,v 1.4 2007/09/04 02:16:56 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -38,22 +38,22 @@ get_tsearch_config_filename(const char *basename,
 {
        char            sharepath[MAXPGPATH];
        char       *result;
-       const char *p;
 
        /*
-        * We enforce that the basename is all alpha characters.  This may be
-        * overly restrictive, but we don't want to allow access to anything
+        * We limit the basename to contain a-z, 0-9, and underscores.  This may
+        * be overly restrictive, but we don't want to allow access to anything
         * outside the tsearch_data directory, so for instance '/' *must* be
-        * rejected.  This is the same test used for timezonesets names.
+        * rejected, and on some platforms '\' and ':' are risky as well.
+        * Allowing uppercase might result in incompatible behavior between
+        * case-sensitive and case-insensitive filesystems, and non-ASCII
+        * characters create other interesting risks, so on the whole a tight
+        * policy seems best.
         */
-       for (p = basename; *p; p++)
-       {
-               if (!isalpha((unsigned char) *p))
-                       ereport(ERROR,
-                                       (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
-                                        errmsg("invalid text search configuration file name \"%s\"",
-                                                       basename)));
-       }
+       if (strspn(basename, "abcdefghijklmnopqrstuvwxyz0123456789_") != strlen(basename))
+               ereport(ERROR,
+                               (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
+                                errmsg("invalid text search configuration file name \"%s\"",
+                                               basename)));
 
        get_share_path(my_exec_path, sharepath);
        result = palloc(MAXPGPATH);