From 0f271e8e8d9c8db0ea86c0d12b3221009b81d8bf Mon Sep 17 00:00:00 2001
From: Amit Langote
Date: Wed, 19 Jun 2024 15:22:06 +0900
Subject: SQL/JSON: Correct jsonpath variable name matching

Previously, GetJsonPathVar() allowed a jsonpath expression to
reference any prefix of a PASSING variable's name. For example, the
following query would incorrectly work:

SELECT JSON_QUERY(context_item, jsonpath '$xy' PASSING val AS xyz);

The fix ensures that the length of the variable name mentioned in a
jsonpath expression matches exactly with the name of the PASSING
variable before comparing the strings using strncmp().

Reported-by: Alvaro Herrera (off-list)
Discussion: https://postgr.es/m/CA+HiwqFGkLWMvELBH6E4SQ45qUHthgcRH6gCJL20OsYDRtFx_w@mail.gmail.com
---
 src/include/utils/jsonpath.h | 1 +
 1 file changed, 1 insertion(+)

(limited to 'src/include')

diff --git a/src/include/utils/jsonpath.h b/src/include/utils/jsonpath.h
index 9d2b8533d54..ee35698d083 100644
--- a/src/include/utils/jsonpath.h
+++ b/src/include/utils/jsonpath.h
@@ -287,6 +287,7 @@ extern bool jspConvertRegexFlags(uint32 xflags, int *result,
 typedef struct JsonPathVariable
 {
 	char	   *name;
+	int			namelen;		/* strlen(name) as cache for GetJsonPathVar() */
 	Oid			typid;
 	int32		typmod;
 	Datum		value;
-- 
cgit v1.2.3