Re:Finding an authorization bypass on my own website
by hn_throwaway_99 on Sunday March 06, 2022 @10:58AM
(#30578387)
> This generally requires one call to prepare the statement and fetch some sort of handle, and then executing the statement with the handle from the first call.
Not always. The Node `pg` module pipelines down the commands on the connection: it sends a `prepare` command, then a `bind` command, then an `execute` command. Yes, it uses prepared statements under the hood, but there is no wire round trip between prepare and bind.
Re:Finding an authorization bypass on my own website
by tomnipotent on Sunday March 06, 2022 @06:42PM
(#30582414)
Looks like Postgres 14 added pipeline mode in libpq, good to know!
You're not sending a parameterized query. The libraries are creating prepared statements under the hood, and managing them for you. This generally requires one call to prepare the statement and fetch some sort of handle, and then executing the statement with the handle from the first call.
Part of the confusion is that it's common to see SQL libraries offer an API to parametrize queries using some sort of placeholder in the query, but it's really just a facade to perform local string interpolation along with some sort of vendor-specific sanitation scheme.