Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit4f3b2a8

Browse files
committed
Enforce ALL/SELECT policies in RETURNING for RLS
For the UPDATE/DELETE RETURNING case, filter the records which are notvisible to the user through ALL or SELECT policies from those consideredfor the UPDATE or DELETE. This is similar to how the GRANT systemworks, which prevents RETURNING unless the caller has SELECT rights onthe relation.Per discussion with Robert, Dean, Tom, and Kevin.Back-patch to 9.5 where RLS was introduced.
1 parent22eaf35 commit4f3b2a8

File tree

2 files changed

+74
-23
lines changed

2 files changed

+74
-23
lines changed

‎src/backend/rewrite/rowsecurity.c

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,33 @@ get_row_security_policies(Query *root, RangeTblEntry *rte, int rt_index,
186186
securityQuals,
187187
hasSubLinks);
188188

189+
/*
190+
* For the target relation, when there is a returning list, we need to
191+
* collect up CMD_SELECT policies and add them via add_security_quals.
192+
* This is because, for the RETURNING case, we have to filter any records
193+
* which are not visible through an ALL or SELECT USING policy.
194+
*
195+
* We don't need to worry about the non-target relation case because we are
196+
* checking the ALL and SELECT policies for those relations anyway (see
197+
* above).
198+
*/
199+
if (root->returningList!=NIL&&
200+
(commandType==CMD_UPDATE||commandType==CMD_DELETE))
201+
{
202+
List*returning_permissive_policies;
203+
List*returning_restrictive_policies;
204+
205+
get_policies_for_relation(rel,CMD_SELECT,user_id,
206+
&returning_permissive_policies,
207+
&returning_restrictive_policies);
208+
209+
add_security_quals(rt_index,
210+
returning_permissive_policies,
211+
returning_restrictive_policies,
212+
securityQuals,
213+
hasSubLinks);
214+
}
215+
189216
/*
190217
* For INSERT and UPDATE, add withCheckOptions to verify that any new
191218
* records added are consistent with the security policies. This will use
@@ -233,6 +260,26 @@ get_row_security_policies(Query *root, RangeTblEntry *rte, int rt_index,
233260
withCheckOptions,
234261
hasSubLinks);
235262

263+
/*
264+
* Get and add ALL/SELECT policies, if there is a RETURNING clause,
265+
* also as WCO policies, again, to avoid silently dropping data.
266+
*/
267+
if (root->returningList!=NIL)
268+
{
269+
List*conflict_returning_permissive_policies=NIL;
270+
List*conflict_returning_restrictive_policies=NIL;
271+
272+
get_policies_for_relation(rel,CMD_SELECT,user_id,
273+
&conflict_returning_permissive_policies,
274+
&conflict_returning_restrictive_policies);
275+
add_with_check_options(rel,rt_index,
276+
WCO_RLS_CONFLICT_CHECK,
277+
conflict_returning_permissive_policies,
278+
conflict_returning_restrictive_policies,
279+
withCheckOptions,
280+
hasSubLinks);
281+
}
282+
236283
/* Enforce the WITH CHECK clauses of the UPDATE policies */
237284
add_with_check_options(rel,rt_index,
238285
WCO_RLS_UPDATE_CHECK,

‎src/test/regress/expected/rowsecurity.out

Lines changed: 27 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1246,21 +1246,23 @@ NOTICE: f_leak => cde
12461246
EXPLAIN (COSTS OFF) UPDATE t2 t2_1 SET b = t2_2.b FROM t2 t2_2
12471247
WHERE t2_1.a = 3 AND t2_2.a = t2_1.a AND t2_2.b = t2_1.b
12481248
AND f_leak(t2_1.b) AND f_leak(t2_2.b) RETURNING *, t2_1, t2_2;
1249-
QUERY PLAN
1250-
---------------------------------------------------------------
1249+
QUERY PLAN
1250+
---------------------------------------------------------------------
12511251
Update on t2 t2_1_1
12521252
-> Nested Loop
12531253
Join Filter: (t2_1.b = t2_2.b)
12541254
-> Subquery Scan on t2_1
12551255
Filter: f_leak(t2_1.b)
1256-
-> LockRows
1257-
-> Seq Scan on t2 t2_1_2
1258-
Filter: ((a = 3) AND ((a % 2) = 1))
1256+
-> Subquery Scan on t2_1_2
1257+
Filter: ((t2_1_2.a % 2) = 1)
1258+
-> LockRows
1259+
-> Seq Scan on t2 t2_1_3
1260+
Filter: ((a = 3) AND ((a % 2) = 1))
12591261
-> Subquery Scan on t2_2
12601262
Filter: f_leak(t2_2.b)
12611263
-> Seq Scan on t2 t2_2_1
12621264
Filter: ((a = 3) AND ((a % 2) = 1))
1263-
(12 rows)
1265+
(14 rows)
12641266

12651267
UPDATE t2 t2_1 SET b = t2_2.b FROM t2 t2_2
12661268
WHERE t2_1.a = 3 AND t2_2.a = t2_1.a AND t2_2.b = t2_1.b
@@ -1275,8 +1277,8 @@ NOTICE: f_leak => cde
12751277
EXPLAIN (COSTS OFF) UPDATE t1 t1_1 SET b = t1_2.b FROM t1 t1_2
12761278
WHERE t1_1.a = 4 AND t1_2.a = t1_1.a AND t1_2.b = t1_1.b
12771279
AND f_leak(t1_1.b) AND f_leak(t1_2.b) RETURNING *, t1_1, t1_2;
1278-
QUERY PLAN
1279-
---------------------------------------------------------------
1280+
QUERY PLAN
1281+
---------------------------------------------------------------------
12801282
Update on t1 t1_1_3
12811283
Update on t1 t1_1_3
12821284
Update on t2 t1_1
@@ -1285,9 +1287,11 @@ AND f_leak(t1_1.b) AND f_leak(t1_2.b) RETURNING *, t1_1, t1_2;
12851287
Join Filter: (t1_1.b = t1_2.b)
12861288
-> Subquery Scan on t1_1
12871289
Filter: f_leak(t1_1.b)
1288-
-> LockRows
1289-
-> Seq Scan on t1 t1_1_4
1290-
Filter: ((a = 4) AND ((a % 2) = 0))
1290+
-> Subquery Scan on t1_1_4
1291+
Filter: ((t1_1_4.a % 2) = 0)
1292+
-> LockRows
1293+
-> Seq Scan on t1 t1_1_5
1294+
Filter: ((a = 4) AND ((a % 2) = 0))
12911295
-> Subquery Scan on t1_2
12921296
Filter: f_leak(t1_2.b)
12931297
-> Append
@@ -1301,9 +1305,11 @@ AND f_leak(t1_1.b) AND f_leak(t1_2.b) RETURNING *, t1_1, t1_2;
13011305
Join Filter: (t1_1_1.b = t1_2_1.b)
13021306
-> Subquery Scan on t1_1_1
13031307
Filter: f_leak(t1_1_1.b)
1304-
-> LockRows
1305-
-> Seq Scan on t2 t1_1_5
1306-
Filter: ((a = 4) AND ((a % 2) = 0))
1308+
-> Subquery Scan on t1_1_6
1309+
Filter: ((t1_1_6.a % 2) = 0)
1310+
-> LockRows
1311+
-> Seq Scan on t2 t1_1_7
1312+
Filter: ((a = 4) AND ((a % 2) = 0))
13071313
-> Subquery Scan on t1_2_1
13081314
Filter: f_leak(t1_2_1.b)
13091315
-> Append
@@ -1317,9 +1323,11 @@ AND f_leak(t1_1.b) AND f_leak(t1_2.b) RETURNING *, t1_1, t1_2;
13171323
Join Filter: (t1_1_2.b = t1_2_2.b)
13181324
-> Subquery Scan on t1_1_2
13191325
Filter: f_leak(t1_1_2.b)
1320-
-> LockRows
1321-
-> Seq Scan on t3 t1_1_6
1322-
Filter: ((a = 4) AND ((a % 2) = 0))
1326+
-> Subquery Scan on t1_1_8
1327+
Filter: ((t1_1_8.a % 2) = 0)
1328+
-> LockRows
1329+
-> Seq Scan on t3 t1_1_9
1330+
Filter: ((a = 4) AND ((a % 2) = 0))
13231331
-> Subquery Scan on t1_2_2
13241332
Filter: f_leak(t1_2_2.b)
13251333
-> Append
@@ -1329,7 +1337,7 @@ AND f_leak(t1_1.b) AND f_leak(t1_2.b) RETURNING *, t1_1, t1_2;
13291337
Filter: ((a = 4) AND ((a % 2) = 0))
13301338
-> Seq Scan on t3 t1_2_11
13311339
Filter: ((a = 4) AND ((a % 2) = 0))
1332-
(52 rows)
1340+
(58 rows)
13331341

13341342
UPDATE t1 t1_1 SET b = t1_2.b FROM t1 t1_2
13351343
WHERE t1_1.a = 4 AND t1_2.a = t1_1.a AND t1_2.b = t1_1.b
@@ -1960,8 +1968,6 @@ NOTICE: f_leak => fgh_updt
19601968
(6 rows)
19611969

19621970
DELETE FROM x1 WHERE f_leak(b) RETURNING *;
1963-
NOTICE: f_leak => abc_updt
1964-
NOTICE: f_leak => efg_updt
19651971
NOTICE: f_leak => cde_updt
19661972
NOTICE: f_leak => fgh_updt
19671973
NOTICE: f_leak => bcd_updt_updt
@@ -1970,15 +1976,13 @@ NOTICE: f_leak => fgh_updt_updt
19701976
NOTICE: f_leak => fgh_updt_updt
19711977
a | b | c
19721978
---+---------------+-------------------
1973-
1 | abc_updt | rls_regress_user1
1974-
5 | efg_updt | rls_regress_user1
19751979
3 | cde_updt | rls_regress_user2
19761980
7 | fgh_updt | rls_regress_user2
19771981
2 | bcd_updt_updt | rls_regress_user1
19781982
4 | def_updt_updt | rls_regress_user2
19791983
6 | fgh_updt_updt | rls_regress_user1
19801984
8 | fgh_updt_updt | rls_regress_user2
1981-
(8 rows)
1985+
(6 rows)
19821986

19831987
--
19841988
-- Duplicate Policy Names

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp