Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit2062007

Browse files
committed
Require the schema qualification in pg_temp.type_name(arg).
Commitaa27977 introduced thisrestriction for pg_temp.function_name(arg); do likewise for typescreated in temporary schemas. Programs that this breaks should add"pg_temp." schema qualification or switch to arg::type_name syntax.Back-patch to 9.4 (all supported versions).Reviewed by Tom Lane. Reported by Tom Lane.Security:CVE-2019-10208
1 parent5e32ae9 commit2062007

File tree

9 files changed

+83
-5
lines changed

9 files changed

+83
-5
lines changed

‎doc/src/sgml/config.sgml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6207,6 +6207,10 @@ COPY postgres_log FROM '/full/path/to/logfile.csv' WITH csv;
62076207
be searched <emphasis>before</> searching any of the path items.
62086208
</para>
62096209

6210+
<!-- To further split hairs, funcname('foo') does not use the temporary
6211+
schema, even when it considers typname='funcname'. This paragraph
6212+
refers to function names in a loose sense, "pg_proc.proname or
6213+
func_name grammar production". -->
62106214
<para>
62116215
Likewise, the current session's temporary-table schema,
62126216
<literal>pg_temp_<replaceable>nnn</></>, is always searched if it

‎src/backend/catalog/namespace.c

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -738,13 +738,23 @@ RelationIsVisible(Oid relid)
738738

739739
/*
740740
* TypenameGetTypid
741+
*Wrapper for binary compatibility.
742+
*/
743+
Oid
744+
TypenameGetTypid(constchar*typname)
745+
{
746+
returnTypenameGetTypidExtended(typname, true);
747+
}
748+
749+
/*
750+
* TypenameGetTypidExtended
741751
*Try to resolve an unqualified datatype name.
742752
*Returns OID if type found in search path, else InvalidOid.
743753
*
744754
* This is essentially the same as RelnameGetRelid.
745755
*/
746756
Oid
747-
TypenameGetTypid(constchar*typname)
757+
TypenameGetTypidExtended(constchar*typname,booltemp_ok)
748758
{
749759
Oidtypid;
750760
ListCell*l;
@@ -755,6 +765,9 @@ TypenameGetTypid(const char *typname)
755765
{
756766
OidnamespaceId=lfirst_oid(l);
757767

768+
if (!temp_ok&&namespaceId==myTempNamespace)
769+
continue;/* do not look in temp namespace */
770+
758771
typid=GetSysCacheOid2(TYPENAMENSP,
759772
PointerGetDatum(typname),
760773
ObjectIdGetDatum(namespaceId));

‎src/backend/parser/parse_func.c

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1769,7 +1769,12 @@ FuncNameAsType(List *funcname)
17691769
Oidresult;
17701770
Typetyptup;
17711771

1772-
typtup=LookupTypeName(NULL,makeTypeNameFromNameList(funcname),NULL, false);
1772+
/*
1773+
* temp_ok=false protects the <refsect1 id="sql-createfunction-security">
1774+
* contract for writing SECURITY DEFINER functions safely.
1775+
*/
1776+
typtup=LookupTypeNameExtended(NULL,makeTypeNameFromNameList(funcname),
1777+
NULL, false, false);
17731778
if (typtup==NULL)
17741779
returnInvalidOid;
17751780

‎src/backend/parser/parse_type.c

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,18 @@ static int32 typenameTypeMod(ParseState *pstate, const TypeName *typeName,
3333

3434
/*
3535
* LookupTypeName
36+
*Wrapper for typical case.
37+
*/
38+
Type
39+
LookupTypeName(ParseState*pstate,constTypeName*typeName,
40+
int32*typmod_p,boolmissing_ok)
41+
{
42+
returnLookupTypeNameExtended(pstate,
43+
typeName,typmod_p, true,missing_ok);
44+
}
45+
46+
/*
47+
* LookupTypeNameExtended
3648
*Given a TypeName object, lookup the pg_type syscache entry of the type.
3749
*Returns NULL if no such type can be found. If the type is found,
3850
*the typmod value represented in the TypeName struct is computed and
@@ -51,11 +63,17 @@ static int32 typenameTypeMod(ParseState *pstate, const TypeName *typeName,
5163
* found but is a shell, and there is typmod decoration, an error will be
5264
* thrown --- this is intentional.
5365
*
66+
* If temp_ok is false, ignore types in the temporary namespace. Pass false
67+
* when the caller will decide, using goodness of fit criteria, whether the
68+
* typeName is actually a type or something else. If typeName always denotes
69+
* a type (or denotes nothing), pass true.
70+
*
5471
* pstate is only used for error location info, and may be NULL.
5572
*/
5673
Type
57-
LookupTypeName(ParseState*pstate,constTypeName*typeName,
58-
int32*typmod_p,boolmissing_ok)
74+
LookupTypeNameExtended(ParseState*pstate,
75+
constTypeName*typeName,int32*typmod_p,
76+
booltemp_ok,boolmissing_ok)
5977
{
6078
Oidtypoid;
6179
HeapTupletup;
@@ -172,7 +190,7 @@ LookupTypeName(ParseState *pstate, const TypeName *typeName,
172190
else
173191
{
174192
/* Unqualified type name, so search the search path */
175-
typoid=TypenameGetTypid(typname);
193+
typoid=TypenameGetTypidExtended(typname,temp_ok);
176194
}
177195

178196
/* If an array reference, return the array type instead */

‎src/backend/utils/adt/ruleutils.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9275,6 +9275,14 @@ get_coercion_expr(Node *arg, deparse_context *context,
92759275
if (!PRETTY_PAREN(context))
92769276
appendStringInfoChar(buf,')');
92779277
}
9278+
9279+
/*
9280+
* Never emit resulttype(arg) functional notation. A pg_proc entry could
9281+
* take precedence, and a resulttype in pg_temp would require schema
9282+
* qualification that format_type_with_typemod() would usually omit. We've
9283+
* standardized on arg::resulttype, but CAST(arg AS resulttype) notation
9284+
* would work fine.
9285+
*/
92789286
appendStringInfo(buf,"::%s",
92799287
format_type_with_typemod(resulttype,resulttypmod));
92809288
}

‎src/include/catalog/namespace.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ extern OidRelnameGetRelid(const char *relname);
6666
externboolRelationIsVisible(Oidrelid);
6767

6868
externOidTypenameGetTypid(constchar*typname);
69+
externOidTypenameGetTypidExtended(constchar*typname,booltemp_ok);
6970
externboolTypeIsVisible(Oidtypid);
7071

7172
externFuncCandidateListFuncnameGetCandidates(List*names,

‎src/include/parser/parse_type.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ typedef HeapTuple Type;
2121

2222
externTypeLookupTypeName(ParseState*pstate,constTypeName*typeName,
2323
int32*typmod_p,boolmissing_ok);
24+
externTypeLookupTypeNameExtended(ParseState*pstate,
25+
constTypeName*typeName,int32*typmod_p,
26+
booltemp_ok,boolmissing_ok);
2427
externOidLookupTypeNameOid(ParseState*pstate,constTypeName*typeName,
2528
boolmissing_ok);
2629
externTypetypenameType(ParseState*pstate,constTypeName*typeName,

‎src/test/regress/expected/temp.out

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,21 @@ select pg_temp.whoami();
199199
(1 row)
200200

201201
drop table public.whereami;
202+
-- types in temp schema
203+
set search_path = pg_temp, public;
204+
create domain pg_temp.nonempty as text check (value <> '');
205+
-- function-syntax invocation of types matches rules for functions
206+
select nonempty('');
207+
ERROR: function nonempty(unknown) does not exist
208+
LINE 1: select nonempty('');
209+
^
210+
HINT: No function matches the given name and argument types. You might need to add explicit type casts.
211+
select pg_temp.nonempty('');
212+
ERROR: value for domain nonempty violates check constraint "nonempty_check"
213+
-- other syntax matches rules for tables
214+
select ''::nonempty;
215+
ERROR: value for domain nonempty violates check constraint "nonempty_check"
216+
reset search_path;
202217
-- For partitioned temp tables, ON COMMIT actions ignore storage-less
203218
-- partitioned tables.
204219
begin;

‎src/test/regress/sql/temp.sql

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,17 @@ select pg_temp.whoami();
152152

153153
droptablepublic.whereami;
154154

155+
-- types in temp schema
156+
set search_path= pg_temp, public;
157+
createdomainpg_temp.nonemptyastextcheck (value<>'');
158+
-- function-syntax invocation of types matches rules for functions
159+
select nonempty('');
160+
selectpg_temp.nonempty('');
161+
-- other syntax matches rules for tables
162+
select''::nonempty;
163+
164+
reset search_path;
165+
155166
-- For partitioned temp tables, ON COMMIT actions ignore storage-less
156167
-- partitioned tables.
157168
begin;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp