Ignore attempts to \gset into specially treated variables.

Noah Misch <noah@leadboat.com>

Commit: 7b356c78f67099db0bb5dc20663adcedc273c7a0
Author: Noah Misch <noah@leadboat.com>
Date: 2020-11-09T15:32:13Z
Releases: 11.10
Ignore attempts to \gset into specially treated variables.

If an interactive psql session used \gset when querying a compromised
server, the attacker could execute arbitrary code as the operating
system account running psql.  Using a prefix not found among specially
treated variables, e.g. every lowercase string, precluded the attack.
Fix by issuing a warning and setting no variable for the column in
question.  Users wanting the old behavior can use a prefix and then a
meta-command like "\set HISTSIZE :prefix_HISTSIZE".  Back-patch to 9.5
(all supported versions).

Reviewed by Robert Haas.  Reported by Nick Cleaton.

Security: CVE-2020-25696

Files

PathChange+/−
src/bin/psql/common.c modified +7 −0
src/bin/psql/variables.c modified +26 −0
src/bin/psql/variables.h modified +1 −0
src/test/regress/expected/psql.out modified +4 −0
src/test/regress/sql/psql.sql modified +3 −0