Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit9b92f11

Browse files
committed
Convert newlines to spaces in names written in v11+ pg_dump comments.
Maliciously-crafted object names could achieve SQL injection duringrestore.CVE-2012-0868 fixed this class of problem at the time, butlater work reintroduced three cases. Commitbc8cd50 (back-patched to v11+ in2023-05 releases) introduced the pg_dump case. Commit6cbdbd9 (v12+) introduced the twopg_dumpall cases. Move sanitize_line(), unchanged, to dumputils.c sopg_dumpall has access to it in all supported versions. Back-patch tov13 (all supported versions).Reviewed-by: Robert Haas <robertmhaas@gmail.com>Reviewed-by: Nathan Bossart <nathandbossart@gmail.com>Backpatch-through: 13Security:CVE-2025-8715
1 parentac4c0d3 commit9b92f11

File tree

7 files changed

+90
-41
lines changed

7 files changed

+90
-41
lines changed

‎src/bin/pg_dump/dumputils.c‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,43 @@ static void AddAcl(PQExpBuffer aclbuf, const char *keyword,
2929
constchar*subname);
3030

3131

32+
/*
33+
* Sanitize a string to be included in an SQL comment or TOC listing, by
34+
* replacing any newlines with spaces. This ensures each logical output line
35+
* is in fact one physical output line, to prevent corruption of the dump
36+
* (which could, in the worst case, present an SQL injection vulnerability
37+
* if someone were to incautiously load a dump containing objects with
38+
* maliciously crafted names).
39+
*
40+
* The result is a freshly malloc'd string. If the input string is NULL,
41+
* return a malloc'ed empty string, unless want_hyphen, in which case return a
42+
* malloc'ed hyphen.
43+
*
44+
* Note that we currently don't bother to quote names, meaning that the name
45+
* fields aren't automatically parseable. "pg_restore -L" doesn't care because
46+
* it only examines the dumpId field, but someday we might want to try harder.
47+
*/
48+
char*
49+
sanitize_line(constchar*str,boolwant_hyphen)
50+
{
51+
char*result;
52+
char*s;
53+
54+
if (!str)
55+
returnpg_strdup(want_hyphen ?"-" :"");
56+
57+
result=pg_strdup(str);
58+
59+
for (s=result;*s!='\0';s++)
60+
{
61+
if (*s=='\n'||*s=='\r')
62+
*s=' ';
63+
}
64+
65+
returnresult;
66+
}
67+
68+
3269
/*
3370
* Build GRANT/REVOKE command(s) for an object.
3471
*

‎src/bin/pg_dump/dumputils.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
#endif
3737

3838

39+
externchar*sanitize_line(constchar*str,boolwant_hyphen);
3940
externboolbuildACLCommands(constchar*name,constchar*subname,constchar*nspname,
4041
constchar*type,constchar*acls,constchar*baseacls,
4142
constchar*owner,constchar*prefix,intremoteVersion,

‎src/bin/pg_dump/pg_backup_archiver.c‎

Lines changed: 0 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,6 @@ static ArchiveHandle *_allocAH(const char *FileSpec, const ArchiveFormat fmt,
5454
DataDirSyncMethodsync_method);
5555
staticvoid_getObjectDescription(PQExpBufferbuf,constTocEntry*te);
5656
staticvoid_printTocEntry(ArchiveHandle*AH,TocEntry*te,boolisData);
57-
staticchar*sanitize_line(constchar*str,boolwant_hyphen);
5857
staticvoid_doSetFixedOutputState(ArchiveHandle*AH);
5958
staticvoid_doSetSessionAuth(ArchiveHandle*AH,constchar*user);
6059
staticvoid_reconnectToDB(ArchiveHandle*AH,constchar*dbname);
@@ -3915,42 +3914,6 @@ _printTocEntry(ArchiveHandle *AH, TocEntry *te, bool isData)
39153914
}
39163915
}
39173916

3918-
/*
3919-
* Sanitize a string to be included in an SQL comment or TOC listing, by
3920-
* replacing any newlines with spaces. This ensures each logical output line
3921-
* is in fact one physical output line, to prevent corruption of the dump
3922-
* (which could, in the worst case, present an SQL injection vulnerability
3923-
* if someone were to incautiously load a dump containing objects with
3924-
* maliciously crafted names).
3925-
*
3926-
* The result is a freshly malloc'd string. If the input string is NULL,
3927-
* return a malloc'ed empty string, unless want_hyphen, in which case return a
3928-
* malloc'ed hyphen.
3929-
*
3930-
* Note that we currently don't bother to quote names, meaning that the name
3931-
* fields aren't automatically parseable. "pg_restore -L" doesn't care because
3932-
* it only examines the dumpId field, but someday we might want to try harder.
3933-
*/
3934-
staticchar*
3935-
sanitize_line(constchar*str,boolwant_hyphen)
3936-
{
3937-
char*result;
3938-
char*s;
3939-
3940-
if (!str)
3941-
returnpg_strdup(want_hyphen ?"-" :"");
3942-
3943-
result=pg_strdup(str);
3944-
3945-
for (s=result;*s!='\0';s++)
3946-
{
3947-
if (*s=='\n'||*s=='\r')
3948-
*s=' ';
3949-
}
3950-
3951-
returnresult;
3952-
}
3953-
39543917
/*
39553918
* Write the file header for a custom-format archive
39563919
*/

‎src/bin/pg_dump/pg_dump.c‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2657,11 +2657,14 @@ dumpTableData(Archive *fout, const TableDataInfo *tdinfo)
26572657
forcePartitionRootLoad(tbinfo)))
26582658
{
26592659
TableInfo *parentTbinfo;
2660+
char *sanitized;
26602661

26612662
parentTbinfo = getRootTableInfo(tbinfo);
26622663
copyFrom = fmtQualifiedDumpable(parentTbinfo);
2664+
sanitized = sanitize_line(copyFrom, true);
26632665
printfPQExpBuffer(copyBuf, "-- load via partition root %s",
2664-
copyFrom);
2666+
sanitized);
2667+
free(sanitized);
26652668
tdDefn = pg_strdup(copyBuf->data);
26662669
}
26672670
else

‎src/bin/pg_dump/pg_dumpall.c‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1462,7 +1462,13 @@ dumpUserConfig(PGconn *conn, const char *username)
14621462
res=executeQuery(conn,buf->data);
14631463

14641464
if (PQntuples(res)>0)
1465-
fprintf(OPF,"\n--\n-- User Config \"%s\"\n--\n\n",username);
1465+
{
1466+
char*sanitized;
1467+
1468+
sanitized=sanitize_line(username, true);
1469+
fprintf(OPF,"\n--\n-- User Config \"%s\"\n--\n\n",sanitized);
1470+
free(sanitized);
1471+
}
14661472

14671473
for (inti=0;i<PQntuples(res);i++)
14681474
{
@@ -1564,6 +1570,7 @@ dumpDatabases(PGconn *conn)
15641570
for (i=0;i<PQntuples(res);i++)
15651571
{
15661572
char*dbname=PQgetvalue(res,i,0);
1573+
char*sanitized;
15671574
constchar*create_opts;
15681575
intret;
15691576

@@ -1580,7 +1587,9 @@ dumpDatabases(PGconn *conn)
15801587

15811588
pg_log_info("dumping database \"%s\"",dbname);
15821589

1583-
fprintf(OPF,"--\n-- Database \"%s\" dump\n--\n\n",dbname);
1590+
sanitized=sanitize_line(dbname, true);
1591+
fprintf(OPF,"--\n-- Database \"%s\" dump\n--\n\n",sanitized);
1592+
free(sanitized);
15841593

15851594
/*
15861595
* We assume that "template1" and "postgres" already exist in the

‎src/bin/pg_dump/t/002_pg_dump.pl‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1893,6 +1893,27 @@
18931893
},
18941894
},
18951895

1896+
'newline of role or table name in comment'=> {
1897+
create_sql=>qq{CREATE ROLE regress_newline;
1898+
ALTER ROLE regress_newline SET enable_seqscan = off;
1899+
ALTER ROLE regress_newline
1900+
RENAME TO "regress_newline\nattack";
1901+
1902+
-- meet getPartitioningInfo() "unsafe" condition
1903+
CREATE TYPE pp_colors AS
1904+
ENUM ('green', 'blue', 'black');
1905+
CREATE TABLE pp_enumpart (a pp_colors)
1906+
PARTITION BY HASH (a);
1907+
CREATE TABLE pp_enumpart1 PARTITION OF pp_enumpart
1908+
FOR VALUES WITH (MODULUS 2, REMAINDER 0);
1909+
CREATE TABLE pp_enumpart2 PARTITION OF pp_enumpart
1910+
FOR VALUES WITH (MODULUS 2, REMAINDER 1);
1911+
ALTER TABLE pp_enumpart
1912+
RENAME TO "pp_enumpart\nattack";},
1913+
regexp=>qr/\n--[^\n]*\nattack/s,
1914+
like=> {},
1915+
},
1916+
18961917
'CREATE TABLESPACE regress_dump_tablespace'=> {
18971918
create_order=> 2,
18981919
create_sql=>q(

‎src/bin/pg_dump/t/003_pg_dump_with_server.pl‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,22 @@
1616
$node->init;
1717
$node->start;
1818

19+
#########################################
20+
# pg_dumpall: newline in database name
21+
22+
$node->safe_psql('postgres',qq{CREATE DATABASE "regress_\nattack"});
23+
24+
my (@cmd,$stdout,$stderr);
25+
@cmd = ("pg_dumpall",'--port'=>$port,'--exclude-database=postgres');
26+
print("# Running:" .join("",@cmd) ."\n");
27+
my$result = IPC::Run::run \@cmd,'>'=> \$stdout,'2>'=> \$stderr;
28+
ok(!$result,"newline in dbname: exit code not 0");
29+
like(
30+
$stderr,
31+
qr/shell command argument contains a newline/,
32+
"newline in dbname: stderr matches");
33+
unlike($stdout,qr/^attack/m,"newline in dbname: no comment escape");
34+
1935
#########################################
2036
# Verify that dumping foreign data includes only foreign tables of
2137
# matching servers
@@ -26,7 +42,6 @@
2642
$node->safe_psql('postgres',"CREATE SERVER s2 FOREIGN DATA WRAPPER dummy");
2743
$node->safe_psql('postgres',"CREATE FOREIGN TABLE t0 (a int) SERVER s0");
2844
$node->safe_psql('postgres',"CREATE FOREIGN TABLE t1 (a int) SERVER s1");
29-
my ($cmd,$stdout,$stderr,$result);
3045

3146
command_fails_like(
3247
["pg_dump",'-p',$port,'--include-foreign-data=s0','postgres' ],

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp