Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit2ab12d8

Browse files
committed
Block environment variable mutations from trusted PL/Perl.
Many process environment variables (e.g. PATH), bypass the containmentexpected of a trusted PL. Hence, trusted PLs must not offer featuresthat achieve setenv(). Otherwise, an attacker having USAGE privilege onthe language often can achieve arbitrary code execution, even if theattacker lacks a database server operating system user.To fix PL/Perl, replace trusted PL/Perl %ENV with a tied hash that justreplaces each modification attempt with a warning. Sites that reachthese warnings should evaluate the application-specific implications ofproceeding without the environment modification: Can the application reasonably proceed without the modification? If no, switch to plperlu or another approach. If yes, the application should change the code to stop attempting environment modifications. If that's too difficult, add "untie %main::ENV" in any code executed before the warning. For example, one might add it to the start of the affected function or even to the plperl.on_plperl_init setting.In passing, link to Perl's guidance about the Perl features behind thesecurity posture of PL/Perl.Back-patch to v12 (all supported versions).Andrew Dunstan and Noah MischSecurity:CVE-2024-10979
1 parent2af79da commit2ab12d8

File tree

6 files changed

+164
-2
lines changed

6 files changed

+164
-2
lines changed

‎doc/src/sgml/plperl.sgml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1050,6 +1050,19 @@ $$ LANGUAGE plperl;
10501050
be permitted to use this language.
10511051
</para>
10521052

1053+
<warning>
1054+
<para>
1055+
Trusted PL/Perl relies on the Perl <literal>Opcode</literal> module to
1056+
preserve security.
1057+
Perl
1058+
<ulink url="https://perldoc.perl.org/Opcode#WARNING">documents</ulink>
1059+
that the module is not effective for the trusted PL/Perl use case. If
1060+
your security needs are incompatible with the uncertainty in that warning,
1061+
consider executing <literal>REVOKE USAGE ON LANGUAGE plperl FROM
1062+
PUBLIC</literal>.
1063+
</para>
1064+
</warning>
1065+
10531066
<para>
10541067
Here is an example of a function that will not work because file
10551068
system operations are not allowed for security reasons:

‎src/pl/plperl/GNUmakefile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,8 @@ endif # win32
5555

5656
SHLIB_LINK =$(perl_embed_ldflags)
5757

58-
REGRESS_OPTS = --dbname=$(PL_TESTDB) --load-extension=plperl --load-extension=plperlu
59-
REGRESS = plperl plperl_lc plperl_trigger plperl_shared plperl_elog plperl_util plperl_init plperlu plperl_array plperl_call plperl_transaction
58+
REGRESS_OPTS = --dbname=$(PL_TESTDB) --dlpath=$(top_builddir)/src/test/regress --load-extension=plperl --load-extension=plperlu
59+
REGRESS = plperl plperl_lc plperl_trigger plperl_shared plperl_elog plperl_util plperl_init plperlu plperl_array plperl_call plperl_transaction plperl_env
6060
# if Perl can support two interpreters in one backend,
6161
# test plperl-and-plperlu cases
6262
ifneq ($(PERL),)

‎src/pl/plperl/input/plperl_env.source

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
--
2+
-- Test the environment setting
3+
--
4+
5+
CREATE FUNCTION get_environ()
6+
RETURNS text[]
7+
AS '@libdir@/regress@DLSUFFIX@', 'get_environ'
8+
LANGUAGE C STRICT;
9+
10+
-- fetch the process environment
11+
12+
CREATE FUNCTION process_env () RETURNS text[]
13+
LANGUAGE plpgsql AS
14+
$$
15+
16+
declare
17+
res text[];
18+
tmp text[];
19+
f record;
20+
begin
21+
for f in select unnest(get_environ()) as t loop
22+
tmp := regexp_split_to_array(f.t, '=');
23+
if array_length(tmp, 1) = 2 then
24+
res := res || tmp;
25+
end if;
26+
end loop;
27+
return res;
28+
end
29+
30+
$$;
31+
32+
-- plperl should not be able to affect the process environment
33+
34+
DO
35+
$$
36+
$ENV{TEST_PLPERL_ENV_FOO} = "shouldfail";
37+
untie %ENV;
38+
$ENV{TEST_PLPERL_ENV_FOO} = "testval";
39+
my $penv = spi_exec_query("select unnest(process_env()) as pe");
40+
my %received;
41+
for (my $f = 0; $f < $penv->{processed}; $f += 2)
42+
{
43+
my $k = $penv->{rows}[$f]->{pe};
44+
my $v = $penv->{rows}[$f+1]->{pe};
45+
$received{$k} = $v;
46+
}
47+
unless (exists $received{TEST_PLPERL_ENV_FOO})
48+
{
49+
elog(NOTICE, "environ unaffected")
50+
}
51+
52+
$$ LANGUAGE plperl;
Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
--
2+
-- Test the environment setting
3+
--
4+
CREATE FUNCTION get_environ()
5+
RETURNS text[]
6+
AS '@libdir@/regress@DLSUFFIX@', 'get_environ'
7+
LANGUAGE C STRICT;
8+
-- fetch the process environment
9+
CREATE FUNCTION process_env () RETURNS text[]
10+
LANGUAGE plpgsql AS
11+
$$
12+
13+
declare
14+
res text[];
15+
tmp text[];
16+
f record;
17+
begin
18+
for f in select unnest(get_environ()) as t loop
19+
tmp := regexp_split_to_array(f.t, '=');
20+
if array_length(tmp, 1) = 2 then
21+
res := res || tmp;
22+
end if;
23+
end loop;
24+
return res;
25+
end
26+
27+
$$;
28+
-- plperl should not be able to affect the process environment
29+
DO
30+
$$
31+
$ENV{TEST_PLPERL_ENV_FOO} = "shouldfail";
32+
untie %ENV;
33+
$ENV{TEST_PLPERL_ENV_FOO} = "testval";
34+
my $penv = spi_exec_query("select unnest(process_env()) as pe");
35+
my %received;
36+
for (my $f = 0; $f < $penv->{processed}; $f += 2)
37+
{
38+
my $k = $penv->{rows}[$f]->{pe};
39+
my $v = $penv->{rows}[$f+1]->{pe};
40+
$received{$k} = $v;
41+
}
42+
unless (exists $received{TEST_PLPERL_ENV_FOO})
43+
{
44+
elog(NOTICE, "environ unaffected")
45+
}
46+
47+
$$ LANGUAGE plperl;
48+
WARNING: attempted alteration of $ENV{TEST_PLPERL_ENV_FOO} at line 12.
49+
NOTICE: environ unaffected

‎src/pl/plperl/plc_trusted.pl

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,27 @@ package PostgreSQL::InServer::safe; ## no critic (RequireFilenameMatchesPackage)
2727
require Carp::Heavy;
2828
require warnings;
2929
require featureif$] >= 5.010000;
30+
31+
#<<< protect next line from perltidy so perlcritic annotation works
32+
packagePostgreSQL::InServer::WarnEnv;## no critic (RequireFilenameMatchesPackage)
33+
#>>>
34+
35+
use strict;
36+
use warnings;
37+
use Tie::Hash;
38+
our@ISA =qw(Tie::StdHash);
39+
40+
subSTORE {warn"attempted alteration of\$ENV{$_[1]}"; }
41+
subDELETE {warn"attempted deletion of\$ENV{$_[1]}"; }
42+
subCLEAR {warn"attempted clearance of ENV hash"; }
43+
44+
# Remove magic property of %ENV. Changes to this will now not be reflected in
45+
# the process environment.
46+
*main::ENV = {%ENV};
47+
48+
# Block %ENV changes from trusted PL/Perl, and warn. We changed %ENV to just a
49+
# normal hash, yet the application may be expecting the usual Perl %ENV
50+
# magic. Blocking and warning avoids silent application breakage. The user can
51+
# untie or otherwise disable this, e.g. if the lost mutation is unimportant
52+
# and modifying the code to stop that mutation would be onerous.
53+
tie%main::ENV,'PostgreSQL::InServer::WarnEnv',%ENVordie$!;

‎src/test/regress/regress.c

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
#include"optimizer/plancat.h"
3636
#include"port/atomics.h"
3737
#include"storage/spin.h"
38+
#include"utils/array.h"
3839
#include"utils/builtins.h"
3940
#include"utils/geo_decls.h"
4041
#include"utils/rel.h"
@@ -625,6 +626,29 @@ make_tuple_indirect(PG_FUNCTION_ARGS)
625626
PG_RETURN_POINTER(newtup->t_data);
626627
}
627628

629+
PG_FUNCTION_INFO_V1(get_environ);
630+
631+
Datum
632+
get_environ(PG_FUNCTION_ARGS)
633+
{
634+
externchar**environ;
635+
intnvals=0;
636+
ArrayType*result;
637+
Datum*env;
638+
639+
for (char**s=environ;*s;s++)
640+
nvals++;
641+
642+
env=palloc(nvals*sizeof(Datum));
643+
644+
for (inti=0;i<nvals;i++)
645+
env[i]=CStringGetTextDatum(environ[i]);
646+
647+
result=construct_array(env,nvals,TEXTOID,-1, false,'i');
648+
649+
PG_RETURN_POINTER(result);
650+
}
651+
628652
PG_FUNCTION_INFO_V1(regress_putenv);
629653

630654
Datum

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp