Install a data-type-based solution for protecting pg_get_expr().
Tom Lane <tgl@sss.pgh.pa.us>
Install a data-type-based solution for protecting pg_get_expr(). Since the code underlying pg_get_expr() is not secure against malformed input, and can't practically be made so, we need to prevent miscreants from feeding arbitrary data to it. We can do this securely by declaring pg_get_expr() to take a new datatype "pg_node_tree" and declaring the system catalog columns that hold nodeToString output to be of that type. There is no way at SQL level to create a non-null value of type pg_node_tree. Since the backend-internal operations that fill those catalog columns operate below the SQL level, they are oblivious to the datatype relabeling and don't need any changes.
Files
| Path | Change | +/− |
|---|---|---|
| doc/src/sgml/catalogs.sgml | modified | +13 −12 |
| doc/src/sgml/func.sgml | modified | +3 −3 |
| src/backend/bootstrap/bootstrap.c | modified | +5 −2 |
| src/backend/utils/adt/pseudotypes.c | modified | +56 −1 |
| src/include/catalog/catversion.h | modified | +2 −2 |
| src/include/catalog/genbki.h | modified | +3 −2 |
| src/include/catalog/pg_attrdef.h | modified | +5 −5 |
| src/include/catalog/pg_cast.h | modified | +4 −1 |
| src/include/catalog/pg_constraint.h | modified | +2 −2 |
| src/include/catalog/pg_index.h | modified | +3 −3 |
| src/include/catalog/pg_proc.h | modified | +14 −5 |
| src/include/catalog/pg_rewrite.h | modified | +3 −3 |
| src/include/catalog/pg_trigger.h | modified | +2 −2 |
| src/include/catalog/pg_type.h | modified | +6 −2 |
| src/include/utils/builtins.h | modified | +5 −1 |
| src/test/regress/expected/opr_sanity.out | modified | +13 −10 |
| src/test/regress/expected/type_sanity.out | modified | +5 −4 |
| src/test/regress/sql/opr_sanity.sql | modified | +4 −1 |
| src/test/regress/sql/type_sanity.sql | modified | +1 −1 |