Bug: Allow ' in the values in the postgres backend (sqli)

[rud]

Seeing this:

app_config/lib/app_config/storage/postgres.rb

Lines 48 to 56 in 6148df4

	set_attrs = data_hash.map { |k, v| "#{k} = '#{v}'" }.join(', ')
	save_query = "UPDATE #{@table} SET #{set_attrs} WHERE id = #{@id}"
	else # Creating a new row.
	if data_hash.empty?
	save_query = "INSERT INTO #{@table} DEFAULT VALUES"
	else
	columns = data_hash.keys.join(', ')
	values = data_hash.map { |_, v| "'#{v}'" }.join(', ')
	save_query = "INSERT INTO #{@table} (#{columns}) VALUES (#{values})"

I know end-user input is not expected to be stored in a configuration backend, but the code as it stands is classic SQL injection.

This might be relevant: http://deveiate.org/code/pg/PG/Connection.html#method-c-escape_string

[rud]

Oh hey, http://deveiate.org/code/pg/PG/Connection.html#method-i-exec_params is even easier to use, should you be so inclined.

Feel free to close if irrelevant.

[Oshuma]

@rud I can imagine a system where app_config is used to store per-user config (ie, config values accepted from end users), so this could potentially be an issue. I'll investigate when I get some spare time. Thanks for submitting the issue!

[rud]

You're most welcome

[rud]

Welp, this is still open a year later. I know, life happens 🍰 ✌️