-
Notifications
You must be signed in to change notification settings - Fork 177
Description
After using a Postgresql 17.6 pg_dump, there are:
\restrict SOME-RANDOM-KEYas well as
\unrestrict SOME-RANDOM-KEYlines in any output of pg_dump by default.
See changelog:
To provide a positive guarantee that this can't happen, extend psql with a \restrict command that prevents execution of further meta-commands, and teach pg_dump to issue that before any data coming from the source server.
And pg_dump docs: (emphasis mine)
--restrict-key=restrict_key
Use the provided string as the psql \restrict key in the dump output. This can only be specified for plain-text dumps, i.e., when --format is set to plain or the --format option is omitted. If no restrict key is specified, pg_dump will generate a random one as needed. Keys may contain only alphanumeric characters.
This option is primarily intended for testing purposes and other scenarios that require repeatable output (e.g., comparing dump files). It is not recommended for general use, as a malicious server with advance knowledge of the key may be able to inject arbitrary code that will be executed on the machine that runs psql with the dump output.
This lead to ActiveRecord errors like thos one during tenant creation:
ActiveRecord::StatementInvalid:
PG::SyntaxError: ERROR: syntax error at or near "\"
LINE 6: \restrict 1P1FIkBpguclyvatgrVDF9Rund1reVNhFAJpHwksiPSudTYQvU...