Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitb7aac36

Browse files
committed
Handle append_rel_list in expand_security_qual
During expand_security_quals, we take the security barrier quals on anRTE and create a subquery which evaluates the quals. During this, wehave to replace any variables in the outer query which refer to theoriginal RTE with references to the columns from the subquery.We need to also perform that replacement for any Vars in theappend_rel_list.Only backpatching to 9.5 as we only go through this process in 9.4 forauto-updatable security barrier views, which UNION ALL queries aren't.Discovered by Haribabu KommiPatch by Dean Rasheed
1 parent94f5246 commitb7aac36

File tree

3 files changed

+34
-1
lines changed

3 files changed

+34
-1
lines changed

‎src/backend/optimizer/prep/prepsecurity.c

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,12 @@ static bool security_barrier_replace_vars_walker(Node *node,
5656
* the others, providing protection against malicious user-defined security
5757
* barriers. The first security barrier qual in the list will be used in the
5858
* innermost subquery.
59+
*
60+
* In practice, the only RTEs that will have security barrier quals are those
61+
* that refer to tables with row-level security, or which are the target
62+
* relation of an update to an auto-updatable security barrier view. RTEs
63+
* that read from a security barrier view will have already been expanded by
64+
* the rewriter.
5965
*/
6066
void
6167
expand_security_quals(PlannerInfo*root,List*tlist)
@@ -263,7 +269,8 @@ expand_security_qual(PlannerInfo *root, List *tlist, int rt_index,
263269
* Replace any variables in the outer query that refer to the
264270
* original relation RTE with references to columns that we will
265271
* expose in the new subquery, building the subquery's targetlist
266-
* as we go.
272+
* as we go. Also replace any references in the translated_vars
273+
* lists of any appendrels.
267274
*/
268275
context.rt_index=rt_index;
269276
context.sublevels_up=0;
@@ -274,6 +281,8 @@ expand_security_qual(PlannerInfo *root, List *tlist, int rt_index,
274281

275282
security_barrier_replace_vars((Node*)parse,&context);
276283
security_barrier_replace_vars((Node*)tlist,&context);
284+
security_barrier_replace_vars((Node*)root->append_rel_list,
285+
&context);
277286

278287
heap_close(context.rel,NoLock);
279288

‎src/test/regress/expected/rowsecurity.out

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -640,6 +640,26 @@ EXPLAIN (COSTS OFF) SELECT * FROM t1 WHERE f_leak(b) FOR SHARE;
640640
Filter: ((a % 2) = 0)
641641
(12 rows)
642642

643+
-- union all query
644+
SELECT a, b, oid FROM t2 UNION ALL SELECT a, b, oid FROM t3;
645+
a | b | oid
646+
---+-----+-----
647+
1 | abc | 201
648+
3 | cde | 203
649+
1 | xxx | 301
650+
2 | yyy | 302
651+
3 | zzz | 303
652+
(5 rows)
653+
654+
EXPLAIN (COSTS OFF) SELECT a, b, oid FROM t2 UNION ALL SELECT a, b, oid FROM t3;
655+
QUERY PLAN
656+
-------------------------------
657+
Append
658+
-> Seq Scan on t2
659+
Filter: ((a % 2) = 1)
660+
-> Seq Scan on t3
661+
(4 rows)
662+
643663
-- superuser is allowed to bypass RLS checks
644664
RESET SESSION AUTHORIZATION;
645665
SET row_security TO OFF;

‎src/test/regress/sql/rowsecurity.sql

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -255,6 +255,10 @@ EXPLAIN (COSTS OFF) SELECT * FROM t1 FOR SHARE;
255255
SELECT*FROM t1WHERE f_leak(b) FOR SHARE;
256256
EXPLAIN (COSTS OFF)SELECT*FROM t1WHERE f_leak(b) FOR SHARE;
257257

258+
-- union all query
259+
SELECT a, b,oidFROM t2UNION ALLSELECT a, b,oidFROM t3;
260+
EXPLAIN (COSTS OFF)SELECT a, b,oidFROM t2UNION ALLSELECT a, b,oidFROM t3;
261+
258262
-- superuser is allowed to bypass RLS checks
259263
RESET SESSION AUTHORIZATION;
260264
SET row_security TO OFF;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp