NotificationsYou must be signed in to change notification settings
Fork5
Star26

Commitbfed4ab

committed

Disallow SET SESSION AUTHORIZATION pg_*

As part of reserving the pg_* namespace for default roles and in linewith SET ROLE and other previous efforts, disallow settings the roleto a default/reserved role using SET SESSION AUTHORIZATION.These checks and restrictions on what is allowed regarding default /reserved roles are under debate, but it seems prudent to ensure thatthe existing checks at least cover the intended cases while thedebate rages on. On me to clean it up if the consensus decision isto remove these checks.

1 parentbe65edd commitbfed4abCopy full SHA for bfed4ab

File tree

1 file changed

-0

lines changed

src/backend/commands
- variable.c

1 file changed

-0

lines changed

`‎src/backend/commands/variable.c`

Lines changed: 4 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -794,6 +794,10 @@ check_session_authorization(char newval, void extra, GucSource source)`
`794`	`794`	`return false;`
`795`	`795`	`}`
`796`	`796`
	`797`	`+/* Do not allow setting role to a reserved role. */`
	`798`	`+if (strncmp(*newval,"pg_",3)==0)`
	`799`	`+return false;`
	`800`	`+`
`797`	`801`	`/* Look up the username */`
`798`	`802`	`roleTup=SearchSysCache1(AUTHNAME,PointerGetDatum(*newval));`
`799`	`803`	`if (!HeapTupleIsValid(roleTup))`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commitbfed4ab

File tree

1 file changed

1 file changed

`‎src/backend/commands/variable.c`

0 commit comments