Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit8ab6a6b

Browse files
committed
In HEAD only, revert kluge solution for preventing misuse of pg_get_expr().
A data-type-based solution, which is much cleaner and more bulletproof,will follow shortly. It seemed best to make this a separate commit though.
1 parentc89a119 commit8ab6a6b

File tree

4 files changed

+4
-134
lines changed

4 files changed

+4
-134
lines changed

‎src/backend/parser/parse_func.c‎

Lines changed: 1 addition & 112 deletions
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,15 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/backend/parser/parse_func.c,v 1.226 2010/08/05 21:45:35 tgl Exp $
11+
* $PostgreSQL: pgsql/src/backend/parser/parse_func.c,v 1.227 2010/09/03 01:26:52 tgl Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
1515
#include"postgres.h"
1616

17-
#include"catalog/pg_attrdef.h"
18-
#include"catalog/pg_constraint.h"
1917
#include"catalog/pg_proc.h"
2018
#include"catalog/pg_type.h"
2119
#include"funcapi.h"
22-
#include"miscadmin.h"
2320
#include"nodes/makefuncs.h"
2421
#include"nodes/nodeFuncs.h"
2522
#include"parser/parse_agg.h"
@@ -29,7 +26,6 @@
2926
#include"parser/parse_target.h"
3027
#include"parser/parse_type.h"
3128
#include"utils/builtins.h"
32-
#include"utils/fmgroids.h"
3329
#include"utils/lsyscache.h"
3430
#include"utils/syscache.h"
3531

@@ -511,9 +507,6 @@ ParseFuncOrColumn(ParseState *pstate, List *funcname, List *fargs,
511507
retval= (Node*)wfunc;
512508
}
513509

514-
/* Hack to protect pg_get_expr() against misuse */
515-
check_pg_get_expr_args(pstate,funcid,fargs);
516-
517510
returnretval;
518511
}
519512

@@ -1600,107 +1593,3 @@ LookupAggNameTypeNames(List *aggname, List *argtypes, bool noError)
16001593

16011594
returnoid;
16021595
}
1603-
1604-
1605-
/*
1606-
* pg_get_expr() is a system function that exposes the expression
1607-
* deparsing functionality in ruleutils.c to users. Very handy, but it was
1608-
* later realized that the functions in ruleutils.c don't check the input
1609-
* rigorously, assuming it to come from system catalogs and to therefore
1610-
* be valid. That makes it easy for a user to crash the backend by passing
1611-
* a maliciously crafted string representation of an expression to
1612-
* pg_get_expr().
1613-
*
1614-
* There's a lot of code in ruleutils.c, so it's not feasible to add
1615-
* water-proof input checking after the fact. Even if we did it once, it
1616-
* would need to be taken into account in any future patches too.
1617-
*
1618-
* Instead, we restrict pg_rule_expr() to only allow input from system
1619-
* catalogs. This is a hack, but it's the most robust and easiest
1620-
* to backpatch way of plugging the vulnerability.
1621-
*
1622-
* This is transparent to the typical usage pattern of
1623-
* "pg_get_expr(systemcolumn, ...)", but will break "pg_get_expr('foo',
1624-
* ...)", even if 'foo' is a valid expression fetched earlier from a
1625-
* system catalog. Hopefully there aren't many clients doing that out there.
1626-
*/
1627-
void
1628-
check_pg_get_expr_args(ParseState*pstate,Oidfnoid,List*args)
1629-
{
1630-
boolallowed= false;
1631-
Node*arg;
1632-
intnetlevelsup;
1633-
1634-
/* if not being called for pg_get_expr, do nothing */
1635-
if (fnoid!=F_PG_GET_EXPR&&fnoid!=F_PG_GET_EXPR_EXT)
1636-
return;
1637-
1638-
/* superusers are allowed to call it anyway (dubious) */
1639-
if (superuser())
1640-
return;
1641-
1642-
/*
1643-
* The first argument must be a Var referencing one of the allowed
1644-
* system-catalog columns. It could be a join alias Var, though.
1645-
*/
1646-
Assert(list_length(args)>1);
1647-
arg= (Node*)linitial(args);
1648-
netlevelsup=0;
1649-
1650-
restart:
1651-
if (IsA(arg,Var))
1652-
{
1653-
Var*var= (Var*)arg;
1654-
RangeTblEntry*rte;
1655-
1656-
netlevelsup+=var->varlevelsup;
1657-
rte=GetRTEByRangeTablePosn(pstate,var->varno,netlevelsup);
1658-
1659-
if (rte->rtekind==RTE_JOIN)
1660-
{
1661-
/* Expand join alias reference */
1662-
if (var->varattno>0&&
1663-
var->varattno <=list_length(rte->joinaliasvars))
1664-
{
1665-
arg= (Node*)list_nth(rte->joinaliasvars,var->varattno-1);
1666-
gotorestart;
1667-
}
1668-
}
1669-
elseif (rte->rtekind==RTE_RELATION)
1670-
{
1671-
switch (rte->relid)
1672-
{
1673-
caseIndexRelationId:
1674-
if (var->varattno==Anum_pg_index_indexprs||
1675-
var->varattno==Anum_pg_index_indpred)
1676-
allowed= true;
1677-
break;
1678-
1679-
caseAttrDefaultRelationId:
1680-
if (var->varattno==Anum_pg_attrdef_adbin)
1681-
allowed= true;
1682-
break;
1683-
1684-
caseProcedureRelationId:
1685-
if (var->varattno==Anum_pg_proc_proargdefaults)
1686-
allowed= true;
1687-
break;
1688-
1689-
caseConstraintRelationId:
1690-
if (var->varattno==Anum_pg_constraint_conbin)
1691-
allowed= true;
1692-
break;
1693-
1694-
caseTypeRelationId:
1695-
if (var->varattno==Anum_pg_type_typdefaultbin)
1696-
allowed= true;
1697-
break;
1698-
}
1699-
}
1700-
}
1701-
1702-
if (!allowed)
1703-
ereport(ERROR,
1704-
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
1705-
errmsg("argument to pg_get_expr() must come from system catalogs")));
1706-
}

‎src/backend/parser/parse_oper.c‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/backend/parser/parse_oper.c,v 1.114 2010/07/29 23:16:33 tgl Exp $
11+
* $PostgreSQL: pgsql/src/backend/parser/parse_oper.c,v 1.115 2010/09/03 01:26:52 tgl Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -869,9 +869,6 @@ make_op(ParseState *pstate, List *opname, Node *ltree, Node *rtree,
869869

870870
ReleaseSysCache(tup);
871871

872-
/* Hack to protect pg_get_expr() against misuse */
873-
check_pg_get_expr_args(pstate,result->opfuncid,args);
874-
875872
return (Expr*)result;
876873
}
877874

@@ -1000,9 +997,6 @@ make_scalar_array_op(ParseState *pstate, List *opname,
1000997

1001998
ReleaseSysCache(tup);
1002999

1003-
/* Hack to protect pg_get_expr() against misuse */
1004-
check_pg_get_expr_args(pstate,result->opfuncid,args);
1005-
10061000
return (Expr*)result;
10071001
}
10081002

‎src/backend/tcop/fastpath.c‎

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/backend/tcop/fastpath.c,v 1.105 2010/07/06 19:18:57 momjian Exp $
11+
* $PostgreSQL: pgsql/src/backend/tcop/fastpath.c,v 1.106 2010/09/03 01:26:52 tgl Exp $
1212
*
1313
* NOTES
1414
* This cruft is the server side of PQfn.
@@ -29,7 +29,6 @@
2929
#include"tcop/fastpath.h"
3030
#include"tcop/tcopprot.h"
3131
#include"utils/acl.h"
32-
#include"utils/fmgroids.h"
3332
#include"utils/lsyscache.h"
3433
#include"utils/snapmgr.h"
3534
#include"utils/syscache.h"
@@ -348,16 +347,6 @@ HandleFunctionRequest(StringInfo msgBuf)
348347
aclcheck_error(aclresult,ACL_KIND_PROC,
349348
get_func_name(fid));
350349

351-
/*
352-
* Restrict access to pg_get_expr(). This reflects the hack in
353-
* transformFuncCall() in parse_expr.c, see comments there for an
354-
* explanation.
355-
*/
356-
if ((fid==F_PG_GET_EXPR||fid==F_PG_GET_EXPR_EXT)&& !superuser())
357-
ereport(ERROR,
358-
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
359-
errmsg("argument to pg_get_expr() must come from system catalogs")));
360-
361350
/*
362351
* Prepare function call info block and insert arguments.
363352
*/

‎src/include/parser/parse_func.h‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
* Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
88
* Portions Copyright (c) 1994, Regents of the University of California
99
*
10-
* $PostgreSQL: pgsql/src/include/parser/parse_func.h,v 1.69 2010/07/29 23:16:33 tgl Exp $
10+
* $PostgreSQL: pgsql/src/include/parser/parse_func.h,v 1.70 2010/09/03 01:26:52 tgl Exp $
1111
*
1212
*-------------------------------------------------------------------------
1313
*/
@@ -82,6 +82,4 @@ extern Oid LookupFuncNameTypeNames(List *funcname, List *argtypes,
8282
externOidLookupAggNameTypeNames(List*aggname,List*argtypes,
8383
boolnoError);
8484

85-
externvoidcheck_pg_get_expr_args(ParseState*pstate,Oidfnoid,List*args);
86-
8785
#endif/* PARSE_FUNC_H */

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp