Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitd20abb5

Browse files
Check for CREATE privilege on the schema in CREATE STATISTICS.
This omission allowed table owners to create statistics in anyschema, potentially leading to unexpected naming conflicts. ForALTER TABLE commands that require re-creating statistics objects,skip this check in case the user has since lost CREATE on theschema. The addition of a second parameter to CreateStatistics()breaks ABI compatibility, but we are unaware of any impactedthird-party code.Reported-by: Jelte Fennema-Nio <postgres@jeltef.nl>Author: Jelte Fennema-Nio <postgres@jeltef.nl>Co-authored-by: Nathan Bossart <nathandbossart@gmail.com>Reviewed-by: Noah Misch <noah@leadboat.com>Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de>Security:CVE-2025-12817Backpatch-through: 13
1 parent585fd9b commitd20abb5

File tree

6 files changed

+88
-4
lines changed

6 files changed

+88
-4
lines changed

‎src/backend/commands/statscmds.c‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ compare_int16(const void *a, const void *b)
6262
*CREATE STATISTICS
6363
*/
6464
ObjectAddress
65-
CreateStatistics(CreateStatsStmt*stmt)
65+
CreateStatistics(CreateStatsStmt*stmt,boolcheck_rights)
6666
{
6767
int16attnums[STATS_MAX_DIMENSIONS];
6868
intnattnums=0;
@@ -172,6 +172,21 @@ CreateStatistics(CreateStatsStmt *stmt)
172172
}
173173
namestrcpy(&stxname,namestr);
174174

175+
/*
176+
* Check we have creation rights in target namespace. Skip check if
177+
* caller doesn't want it.
178+
*/
179+
if (check_rights)
180+
{
181+
AclResultaclresult;
182+
183+
aclresult=object_aclcheck(NamespaceRelationId,namespaceId,
184+
GetUserId(),ACL_CREATE);
185+
if (aclresult!=ACLCHECK_OK)
186+
aclcheck_error(aclresult,OBJECT_SCHEMA,
187+
get_namespace_name(namespaceId));
188+
}
189+
175190
/*
176191
* Deal with the possibility that the statistics object already exists.
177192
*/

‎src/backend/commands/tablecmds.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8873,7 +8873,7 @@ ATExecAddStatistics(AlteredTableInfo *tab, Relation rel,
88738873
/* The CreateStatsStmt has already been through transformStatsStmt */
88748874
Assert(stmt->transformed);
88758875

8876-
address = CreateStatistics(stmt);
8876+
address = CreateStatistics(stmt, !is_rebuild);
88778877

88788878
return address;
88798879
}

‎src/backend/tcop/utility.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1902,7 +1902,7 @@ ProcessUtilitySlow(ParseState *pstate,
19021902
/* Run parse analysis ... */
19031903
stmt=transformStatsStmt(relid,stmt,queryString);
19041904

1905-
address=CreateStatistics(stmt);
1905+
address=CreateStatistics(stmt, true);
19061906
}
19071907
break;
19081908

‎src/include/commands/defrem.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ extern void RemoveOperatorById(Oid operOid);
8181
externObjectAddressAlterOperator(AlterOperatorStmt*stmt);
8282

8383
/* commands/statscmds.c */
84-
externObjectAddressCreateStatistics(CreateStatsStmt*stmt);
84+
externObjectAddressCreateStatistics(CreateStatsStmt*stmt,boolcheck_rights);
8585
externObjectAddressAlterStatistics(AlterStatsStmt*stmt);
8686
externvoidRemoveStatisticsById(OidstatsOid);
8787
externvoidRemoveStatisticsDataById(OidstatsOid,boolinh);

‎src/test/regress/expected/stats_ext.out‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3407,6 +3407,40 @@ SELECT statistics_name, most_common_vals FROM pg_stats_ext_exprs x
34073407
s_expr | {1}
34083408
(2 rows)
34093409

3410+
-- CREATE STATISTICS checks for CREATE on the schema
3411+
RESET SESSION AUTHORIZATION;
3412+
CREATE SCHEMA sts_sch1 CREATE TABLE sts_sch1.tbl (a INT, b INT);
3413+
CREATE SCHEMA sts_sch2;
3414+
GRANT USAGE ON SCHEMA sts_sch1, sts_sch2 TO regress_stats_user1;
3415+
ALTER TABLE sts_sch1.tbl OWNER TO regress_stats_user1;
3416+
SET SESSION AUTHORIZATION regress_stats_user1;
3417+
CREATE STATISTICS ON a, b FROM sts_sch1.tbl;
3418+
ERROR: permission denied for schema sts_sch1
3419+
CREATE STATISTICS sts_sch2.fail ON a, b FROM sts_sch1.tbl;
3420+
ERROR: permission denied for schema sts_sch2
3421+
RESET SESSION AUTHORIZATION;
3422+
GRANT CREATE ON SCHEMA sts_sch1 TO regress_stats_user1;
3423+
SET SESSION AUTHORIZATION regress_stats_user1;
3424+
CREATE STATISTICS ON a, b FROM sts_sch1.tbl;
3425+
CREATE STATISTICS sts_sch2.fail ON a, b FROM sts_sch1.tbl;
3426+
ERROR: permission denied for schema sts_sch2
3427+
RESET SESSION AUTHORIZATION;
3428+
REVOKE CREATE ON SCHEMA sts_sch1 FROM regress_stats_user1;
3429+
GRANT CREATE ON SCHEMA sts_sch2 TO regress_stats_user1;
3430+
SET SESSION AUTHORIZATION regress_stats_user1;
3431+
CREATE STATISTICS ON a, b FROM sts_sch1.tbl;
3432+
ERROR: permission denied for schema sts_sch1
3433+
CREATE STATISTICS sts_sch2.pass1 ON a, b FROM sts_sch1.tbl;
3434+
RESET SESSION AUTHORIZATION;
3435+
GRANT CREATE ON SCHEMA sts_sch1, sts_sch2 TO regress_stats_user1;
3436+
SET SESSION AUTHORIZATION regress_stats_user1;
3437+
CREATE STATISTICS ON a, b FROM sts_sch1.tbl;
3438+
CREATE STATISTICS sts_sch2.pass2 ON a, b FROM sts_sch1.tbl;
3439+
-- re-creating statistics via ALTER TABLE bypasses checks for CREATE on schema
3440+
RESET SESSION AUTHORIZATION;
3441+
REVOKE CREATE ON SCHEMA sts_sch1, sts_sch2 FROM regress_stats_user1;
3442+
SET SESSION AUTHORIZATION regress_stats_user1;
3443+
ALTER TABLE sts_sch1.tbl ALTER COLUMN a TYPE SMALLINT;
34103444
-- Tidy up
34113445
DROP OPERATOR <<< (int, int);
34123446
DROP FUNCTION op_leak(int, int);
@@ -3419,4 +3453,6 @@ NOTICE: drop cascades to 3 other objects
34193453
DETAIL: drop cascades to table tststats.priv_test_parent_tbl
34203454
drop cascades to table tststats.priv_test_tbl
34213455
drop cascades to view tststats.priv_test_view
3456+
DROP SCHEMA sts_sch1, sts_sch2 CASCADE;
3457+
NOTICE: drop cascades to table sts_sch1.tbl
34223458
DROP USER regress_stats_user1;

‎src/test/regress/sql/stats_ext.sql‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1739,6 +1739,38 @@ SELECT statistics_name, most_common_vals FROM pg_stats_ext x
17391739
SELECT statistics_name, most_common_valsFROM pg_stats_ext_exprs x
17401740
WHERE tablename='stats_ext_tbl'ORDER BY ROW(x.*);
17411741

1742+
-- CREATE STATISTICS checks for CREATE on the schema
1743+
RESET SESSION AUTHORIZATION;
1744+
CREATESCHEMAsts_sch1 CREATE TABLEsts_sch1.tbl (aINT, bINT);
1745+
CREATESCHEMAsts_sch2;
1746+
GRANT USAGEON SCHEMA sts_sch1, sts_sch2 TO regress_stats_user1;
1747+
ALTERTABLEsts_sch1.tbl OWNER TO regress_stats_user1;
1748+
SET SESSION AUTHORIZATION regress_stats_user1;
1749+
CREATE STATISTICSON a, bFROMsts_sch1.tbl;
1750+
CREATE STATISTICSsts_sch2.failON a, bFROMsts_sch1.tbl;
1751+
RESET SESSION AUTHORIZATION;
1752+
GRANT CREATEON SCHEMA sts_sch1 TO regress_stats_user1;
1753+
SET SESSION AUTHORIZATION regress_stats_user1;
1754+
CREATE STATISTICSON a, bFROMsts_sch1.tbl;
1755+
CREATE STATISTICSsts_sch2.failON a, bFROMsts_sch1.tbl;
1756+
RESET SESSION AUTHORIZATION;
1757+
REVOKE CREATEON SCHEMA sts_sch1FROM regress_stats_user1;
1758+
GRANT CREATEON SCHEMA sts_sch2 TO regress_stats_user1;
1759+
SET SESSION AUTHORIZATION regress_stats_user1;
1760+
CREATE STATISTICSON a, bFROMsts_sch1.tbl;
1761+
CREATE STATISTICSsts_sch2.pass1ON a, bFROMsts_sch1.tbl;
1762+
RESET SESSION AUTHORIZATION;
1763+
GRANT CREATEON SCHEMA sts_sch1, sts_sch2 TO regress_stats_user1;
1764+
SET SESSION AUTHORIZATION regress_stats_user1;
1765+
CREATE STATISTICSON a, bFROMsts_sch1.tbl;
1766+
CREATE STATISTICSsts_sch2.pass2ON a, bFROMsts_sch1.tbl;
1767+
1768+
-- re-creating statistics via ALTER TABLE bypasses checks for CREATE on schema
1769+
RESET SESSION AUTHORIZATION;
1770+
REVOKE CREATEON SCHEMA sts_sch1, sts_sch2FROM regress_stats_user1;
1771+
SET SESSION AUTHORIZATION regress_stats_user1;
1772+
ALTERTABLEsts_sch1.tbl ALTER COLUMN a TYPESMALLINT;
1773+
17421774
-- Tidy up
17431775
DROPOPERATOR<<< (int,int);
17441776
DROPFUNCTION op_leak(int,int);
@@ -1747,4 +1779,5 @@ DROP FUNCTION op_leak(record, record);
17471779
RESET SESSION AUTHORIZATION;
17481780
DROPTABLE stats_ext_tbl;
17491781
DROPSCHEMA tststats CASCADE;
1782+
DROPSCHEMA sts_sch1, sts_sch2 CASCADE;
17501783
DROPUSER regress_stats_user1;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp