Don't pass strings directly to errdetail() and errhint() - use

%s to unescape them. Fixes a potential security issue (in as yet
unreleased code)

diff --git a/src/pl/plpgsql/src/pl_exec.c b/src/pl/plpgsql/src/pl_exec.c
index 7d8eb9b3467e20a214044258add00996955ec209..03c77eae81aedc2dac2d451872213036755cebfc 100644 (file)
--- a/src/pl/plpgsql/src/pl_exec.c
+++ b/src/pl/plpgsql/src/pl_exec.c
@@ -2538,8 +2538,8 @@ exec_stmt_raise(PLpgSQL_execstate *estate, PLpgSQL_stmt_raise *stmt)
        ereport(stmt->elog_level,
                        (err_code ? errcode(err_code) : 0,
                         errmsg_internal("%s", err_message),
-                        (err_detail != NULL) ? errdetail(err_detail) : 0,
-                        (err_hint != NULL) ? errhint(err_hint) : 0));
+                        (err_detail != NULL) ? errdetail("%s", err_detail) : 0,
+                        (err_hint != NULL) ? errhint("%s", err_hint) : 0));
 
        estate->err_text = NULL;        /* un-suppress... */