A new attack chain for SQL Injection: Dollar-Quote Desync

Blind SQL injection against regex-sanitized PL/pgSQL. How three PostgreSQL features combine into a zero knowledge data exfiltration chain…