{"action":"created","issue":{"url":"https://api.github.com/repos/npgsql/npgsql/issues/734","labels_url":"https://api.github.com/repos/npgsql/npgsql/issues/734/labels{/name}","comments_url":"https://api.github.com/repos/npgsql/npgsql/issues/734/comments","events_url":"https://api.github.com/repos/npgsql/npgsql/issues/734/events","html_url":"https://github.com/npgsql/npgsql/issues/734","id":103208749,"number":734,"title":"SQL injection vulnerability (v2.2.5, CITEXT type)","user":{"login":"maniserowicz","id":397229,"avatar_url":"https://avatars.githubusercontent.com/u/397229?v=3","gravatar_id":"","url":"https://api.github.com/users/maniserowicz","html_url":"https://github.com/maniserowicz","followers_url":"https://api.github.com/users/maniserowicz/followers","following_url":"https://api.github.com/users/maniserowicz/following{/other_user}","gists_url":"https://api.github.com/users/maniserowicz/gists{/gist_id}","starred_url":"https://api.github.com/users/maniserowicz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/maniserowicz/subscriptions","organizations_url":"https://api.github.com/users/maniserowicz/orgs","repos_url":"https://api.github.com/users/maniserowicz/repos","events_url":"https://api.github.com/users/maniserowicz/events{/privacy}","received_events_url":"https://api.github.com/users/maniserowicz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-08-26T08:35:12Z","updated_at":"2015-08-26T10:27:34Z","closed_at":null,"body":"I discovered it when using Simple.Data with PostgreSql (https://github.com/ChrisMH/Simple.Data.PostgreSql).\r\n\r\nThis operation:\r\n\r\n            dynamic new_user = db.Users.Insert(Name: \"name\");\r\n            new_user.Name = \"name with ' apostrophe\";\r\n            db.Users.Update(new_user);\r\n\r\nNpgsql.NpgsqlException: ERROR: 42601: syntax error at or near “apostrophe”\r\n\r\nSQL that is sent to DB looks like this:\r\n\r\nupdate \"public\".\"users\" set \"name\" = (('name with ' apostrophe')), \"description\" = ((NULL)::text) where \"public\".\"users\".\"id\" = ((1)::int4)\r\n\r\n\"Users\" table also has a Description column which is a 'text' type.\r\n\r\nOf course it is trivial to try to rename the user with value \r\n\r\nname for all users'--\r\n\r\nand it will update all records in the table.\r\n\r\nPlease note that this error was NOT present in v2.0.11! It worked just fine with this version.\r\n\r\nWill you consider releasing a fix for v2.2.5?"},"comment":{"url":"https://api.github.com/repos/npgsql/npgsql/issues/comments/134936415","html_url":"https://github.com/npgsql/npgsql/issues/734#issuecomment-134936415","issue_url":"https://api.github.com/repos/npgsql/npgsql/issues/734","id":134936415,"user":{"login":"roji","id":1862641,"avatar_url":"https://avatars.githubusercontent.com/u/1862641?v=3","gravatar_id":"","url":"https://api.github.com/users/roji","html_url":"https://github.com/roji","followers_url":"https://api.github.com/users/roji/followers","following_url":"https://api.github.com/users/roji/following{/other_user}","gists_url":"https://api.github.com/users/roji/gists{/gist_id}","starred_url":"https://api.github.com/users/roji/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/roji/subscriptions","organizations_url":"https://api.github.com/users/roji/orgs","repos_url":"https://api.github.com/users/roji/repos","events_url":"https://api.github.com/users/roji/events{/privacy}","received_events_url":"https://api.github.com/users/roji/received_events","type":"User","site_admin":false},"created_at":"2015-08-26T10:27:34Z","updated_at":"2015-08-26T10:27:34Z","body":"@Emill, any chance you can take a look?\r\n\r\nIf this is an actually issue in 2.2.5 we can backport the fix and release 2.2.6"}}