3 ms·
Because queries like this will kill any db, and you don’t need any privileges SELECT crypt( encode(digest(gen_random_bytes(1024), 'sha512'), 'base64'),
by ruslan_talpa 4y ago
Because queries like this will kill any db, and you don’t need any privileges
SELECT crypt( encode(digest(gen_random_bytes(1024), 'sha512'), 'base64'), gen_salt('bf', 20) )FROM generate_series(1, 1000000)
More explanations here https://www.freecodecamp.org/news/stop-calling-postgrest-magic-8f3e1d5e5dd1/amp/ https://www.freecodecamp.org/news/stop-calling-postgrest-mag...
- RhodesianHunter 4y agoWouldn't it be much easier to disable/restrict certain sql functions than do all of the http->sql mapping?
- 411111111111111 4y agoNo, as there are countless ways to do the same. Whitelisting is more effective if your code is running on untrusted devices (frontend)
- miga 4y agoPostgres can limit queries to only given number of milliseconds.
- ruslan_talpa 4y agoGive me access to your PG with a user that has no privileges, can not run queries longer then X ms and see how easy it would be to DOS the db :)