Could you test this against 1.18?

Reproduced in trunk (r113364)

• Bug 31006 has been marked as a duplicate of this bug. ***

I don't think it's an SQL injection problem.

There is a problem with proper quoting of lexemes passed over to to_tsquery() function.

What we do in this case is:

trunk=> select to_tsquery('''');
ERROR: syntax error in tsquery: "'"

Somebody ran into a similar problem here:

http://archives.postgresql.org/pgsql-sql/2008-08/msg00027.php

It's an arbitrary parameter to_tsquery(), not arbitrary SQL, and my reading of the relevant manual section:

http://www.postgresql.org/docs/8.4/interactive/datatype-textsearch.html

suggests that this is not exploitable. The operations which can be performed are very limited. So I'm changing the component, severity and summary.

karun.84 wrote:

I have submitted a patch to check for ' to gerrit, to stop the database error appearing.
https://gerrit.wikimedia.org/r/#/c/23064/

(In reply to comment #6)

I have submitted a patch to check for ' to gerrit

Patch needs improvement according to review - Karun, would you have time?

Patch needs improvement according to review - Karun, would you have time?

Change 23064 had a related patch set uploaded by Tim Landscheidt:
Escape apostrophes in search terms for PostgreSQL

https://gerrit.wikimedia.org/r/23064

Migrating from the old tracking task to a tag for PostgreSQL-related tasks.

Removing Discovery-ARCHIVED and Discovery-Search; our primary responsibility is to users of the Wikimedia sites, and we do not use Postgres there.

Change 23064 had a related patch set uploaded (by Tim Landscheidt):
[mediawiki/core] Escape apostrophes in search terms for PostgreSQL

https://gerrit.wikimedia.org/r/23064

(As @tstarling already assessed in T37043#399694, this is not exploitable.)