Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit632cd9f

Browse files
committed
Create new ParseExprKind for use by policy expressions.
Policy USING and WITH CHECK expressions were using EXPR_KIND_WHERE forparse analysis, which results in inappropriate ERROR messages whenthe expression contains unsupported constructs such as aggregates.Create a new ParseExprKind called EXPR_KIND_POLICY and tailor therelated messages to fit.Reported by Noah Misch. Reviewed by Dean Rasheed, Alvaro Herrera,and Robert Haas. Back-patch to 9.5 where RLS was introduced.
1 parentf04ce31 commit632cd9f

File tree

7 files changed

+39
-7
lines changed

7 files changed

+39
-7
lines changed

‎src/backend/commands/policy.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -534,12 +534,12 @@ CreatePolicy(CreatePolicyStmt *stmt)
534534

535535
qual=transformWhereClause(qual_pstate,
536536
copyObject(stmt->qual),
537-
EXPR_KIND_WHERE,
537+
EXPR_KIND_POLICY,
538538
"POLICY");
539539

540540
with_check_qual=transformWhereClause(with_check_pstate,
541541
copyObject(stmt->with_check),
542-
EXPR_KIND_WHERE,
542+
EXPR_KIND_POLICY,
543543
"POLICY");
544544

545545
/* Fix up collation information */
@@ -707,7 +707,7 @@ AlterPolicy(AlterPolicyStmt *stmt)
707707
addRTEtoQuery(qual_pstate,rte, false, true, true);
708708

709709
qual=transformWhereClause(qual_pstate,copyObject(stmt->qual),
710-
EXPR_KIND_WHERE,
710+
EXPR_KIND_POLICY,
711711
"POLICY");
712712

713713
/* Fix up collation information */
@@ -730,7 +730,7 @@ AlterPolicy(AlterPolicyStmt *stmt)
730730

731731
with_check_qual=transformWhereClause(with_check_pstate,
732732
copyObject(stmt->with_check),
733-
EXPR_KIND_WHERE,
733+
EXPR_KIND_POLICY,
734734
"POLICY");
735735

736736
/* Fix up collation information */

‎src/backend/parser/parse_agg.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -372,6 +372,13 @@ check_agglevels_and_constraints(ParseState *pstate, Node *expr)
372372
break;
373373
caseEXPR_KIND_WHERE:
374374
errkind= true;
375+
break;
376+
caseEXPR_KIND_POLICY:
377+
if (isAgg)
378+
err=_("aggregate functions are not allowed in policy expressions");
379+
else
380+
err=_("grouping operations are not allowed in policy expressions");
381+
375382
break;
376383
caseEXPR_KIND_HAVING:
377384
/* okay */
@@ -770,6 +777,9 @@ transformWindowFuncCall(ParseState *pstate, WindowFunc *wfunc,
770777
caseEXPR_KIND_WHERE:
771778
errkind= true;
772779
break;
780+
caseEXPR_KIND_POLICY:
781+
err=_("window functions are not allowed in policy expressions");
782+
break;
773783
caseEXPR_KIND_HAVING:
774784
errkind= true;
775785
break;

‎src/backend/parser/parse_expr.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1672,6 +1672,7 @@ transformSubLink(ParseState *pstate, SubLink *sublink)
16721672
caseEXPR_KIND_FROM_SUBSELECT:
16731673
caseEXPR_KIND_FROM_FUNCTION:
16741674
caseEXPR_KIND_WHERE:
1675+
caseEXPR_KIND_POLICY:
16751676
caseEXPR_KIND_HAVING:
16761677
caseEXPR_KIND_FILTER:
16771678
caseEXPR_KIND_WINDOW_PARTITION:
@@ -3173,6 +3174,8 @@ ParseExprKindName(ParseExprKind exprKind)
31733174
return"function in FROM";
31743175
caseEXPR_KIND_WHERE:
31753176
return"WHERE";
3177+
caseEXPR_KIND_POLICY:
3178+
return"POLICY";
31763179
caseEXPR_KIND_HAVING:
31773180
return"HAVING";
31783181
caseEXPR_KIND_FILTER:

‎src/include/parser/parse_node.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,8 @@ typedef enum ParseExprKind
6363
EXPR_KIND_INDEX_PREDICATE,/* index predicate */
6464
EXPR_KIND_ALTER_COL_TRANSFORM,/* transform expr in ALTER COLUMN TYPE */
6565
EXPR_KIND_EXECUTE_PARAMETER,/* parameter value in EXECUTE */
66-
EXPR_KIND_TRIGGER_WHEN/* WHEN condition in CREATE TRIGGER */
66+
EXPR_KIND_TRIGGER_WHEN,/* WHEN condition in CREATE TRIGGER */
67+
EXPR_KIND_POLICY/* USING or WITH CHECK expr in policy */
6768
}ParseExprKind;
6869

6970

‎src/test/modules/test_rls_hooks/test_rls_hooks.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ test_rls_hooks_permissive(CmdType cmdtype, Relation relation)
106106
e= (Node*)makeSimpleA_Expr(AEXPR_OP,"=", (Node*)n, (Node*)c,0);
107107

108108
policy->qual= (Expr*)transformWhereClause(qual_pstate,copyObject(e),
109-
EXPR_KIND_WHERE,
109+
EXPR_KIND_POLICY,
110110
"POLICY");
111111

112112
policy->with_check_qual=copyObject(policy->qual);
@@ -160,7 +160,7 @@ test_rls_hooks_restrictive(CmdType cmdtype, Relation relation)
160160
e= (Node*)makeSimpleA_Expr(AEXPR_OP,"=", (Node*)n, (Node*)c,0);
161161

162162
policy->qual= (Expr*)transformWhereClause(qual_pstate,copyObject(e),
163-
EXPR_KIND_WHERE,
163+
EXPR_KIND_POLICY,
164164
"POLICY");
165165

166166
policy->with_check_qual=copyObject(policy->qual);

‎src/test/regress/expected/rowsecurity.out

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3024,6 +3024,15 @@ CREATE RULE "_RETURN" AS ON SELECT TO t DO INSTEAD
30243024
SELECT * FROM generate_series(1,5) t0(c); -- succeeds
30253025
ROLLBACK;
30263026
--
3027+
-- Policy expression handling
3028+
--
3029+
BEGIN;
3030+
SET row_security = FORCE;
3031+
CREATE TABLE t (c) AS VALUES ('bar'::text);
3032+
CREATE POLICY p ON t USING (max(c)); -- fails: aggregate functions are not allowed in policy expressions
3033+
ERROR: aggregate functions are not allowed in policy expressions
3034+
ROLLBACK;
3035+
--
30273036
-- Clean up objects
30283037
--
30293038
RESET SESSION AUTHORIZATION;

‎src/test/regress/sql/rowsecurity.sql

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1289,6 +1289,15 @@ CREATE RULE "_RETURN" AS ON SELECT TO t DO INSTEAD
12891289
SELECT*FROM generate_series(1,5) t0(c);-- succeeds
12901290
ROLLBACK;
12911291

1292+
--
1293+
-- Policy expression handling
1294+
--
1295+
BEGIN;
1296+
SET row_security= FORCE;
1297+
CREATETABLEt (c)ASVALUES ('bar'::text);
1298+
CREATE POLICY pON t USING (max(c));-- fails: aggregate functions are not allowed in policy expressions
1299+
ROLLBACK;
1300+
12921301
--
12931302
-- Clean up objects
12941303
--

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp