Comment on Show HN: Stellar – Git for PostreSQL and MySQLComments−swehner12yLine 53 of https://github.com/fastmonkeys/stellar/blob/master/stellar/o... is CREATE TABLE %s.%s LIKE %s.%s This made me think of a table called create table `a; drop table users;` (col int); ... which works in mysql.I don't know if the stellar code will trip over something like this. But mysql (SQL) shouldn't even allow names like that.−obsessionOP12yYes, Stellar will probably trip over this. Similarly, if the attacker can edit stellar.yaml, they probably can edit your .bashrc as well.Im adding this to my TODO list.
Comments
Line 53 of https://github.com/fastmonkeys/stellar/blob/master/stellar/o... is
This made me think of a table called ... which works in mysql.I don't know if the stellar code will trip over something like this. But mysql (SQL) shouldn't even allow names like that.
Yes, Stellar will probably trip over this. Similarly, if the attacker can edit stellar.yaml, they probably can edit your .bashrc as well.
Im adding this to my TODO list.