Skip to content

Parsing library should not whitelist keys #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kevinburkeshyp opened this issue Apr 8, 2016 · 5 comments
Closed

Parsing library should not whitelist keys #8

kevinburkeshyp opened this issue Apr 8, 2016 · 5 comments

Comments

@kevinburkeshyp
Copy link

A Postgres connection can take a number of different configuration arguments: http://www.postgresql.org/docs/9.4/static/libpq-connect.html

Only a handful are parsed and returned by this library; all additional configuration parameters are filtered.

The library should assume that the user knows the configuration string they are trying to pass, and pass through that configuration string.

@phated
Copy link

phated commented Apr 8, 2016

I think you are confused what this library is doing. It turns a string into an object usable by node-postgres. I don't see how you would "pass through a configuration string".

@kevinburkeshyp
Copy link
Author

Sorry - as an example, the Go lib/pq library lets you pass through runtime configuration as part of the connection string, see https://godoc.org/github.com/lib/pq#hdr-Connection_String_Parameters. These include any of the values here: http://www.postgresql.org/docs/current/static/runtime-config-client.html

As it's currently implemented, I believe all of these values would be stripped from the connection string by this library

@kevinburkeshyp
Copy link
Author

(there are also changes to node-postgres that would need to get made to make this happen, but I'm trying to figure out the least invasive way to make this change)

@elmigranto
Copy link

elmigranto commented Aug 31, 2016

Relevant pg issue: brianc/node-postgres#1095

It turns a string into an object usable by node-postgres.

Yep, except it drops relevant bits from connection string, like non-whitelisted query string params. So, for example, there is no way to specify time zone (and there is already a bunch of similar issues: #9, #3 with more to come surely).

@hjr3
Copy link
Contributor

hjr3 commented May 23, 2019

Should be resolved by #7

@hjr3 hjr3 closed this as completed May 23, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants