ClickHouse/dbms/programs/odbc-bridge/validateODBCConnectionString.h

22 lines
705 B
C++
Raw Normal View History

#pragma once
#include <string>
namespace DB
{
2018-10-13 14:33:43 +00:00
/** Passing arbitrary connection string to ODBC Driver Manager is insecure, for the following reasons:
* 1. Driver Manager like unixODBC has multiple bugs like buffer overflow.
* 2. Driver Manager can interpret some parameters as a path to library for dlopen or a file to read,
2018-10-13 14:33:43 +00:00
* thus allows arbitrary remote code execution.
*
* This function will throw exception if connection string has insecure parameters.
* It may also modify connection string to harden it.
*
* Note that it is intended for ANSI (not multibyte) variant of connection string.
*/
std::string validateODBCConnectionString(const std::string & connection_string);
}