Inject aggregation function inside a procedure

1 vote

2 answers

94 views

postgresql aggregate dynamic-sql sql-injection sql-procedure

                          Is it possible to inject the name of a function (AVG, MAX...) as a procedure parameter?

    CREATE PROCEDURE test(func TEXT)
    LANGUAGE PLPGSQL
    AS $$
    BEGIN
    DROP TABLE IF EXISTS foo;
    CREATE TEMPORARY TABLE foo AS SELECT 
    func(bar.column_a) as func_column_a
    FROM bar;
    END
    $$;
                        

Asked by jorgeb (25 rep)

Dec 11, 2020, 02:30 PM
Last activity: Dec 11, 2020, 05:24 PM

Inject aggregation function inside a procedure

Related Questions