Fixes for missing schema qualifications
Michael Paquier <michael@paquier.xyz>
From: Michael Paquier <michael@paquier.xyz>
To: Postgres hackers <pgsql-hackers@postgresql.org>
Date: 2018-03-09T07:55:38Z
Lists: pgsql-hackers
Attachments
- 0001-Fix-missing-schema-qualifications-in-code.patch (text/x-diff) patch 0001
Hi all, In light of CVE-2018-1058, user's applications need to be careful about the use of schema-unqualified queries. A lookup at the upstream code is showing four areas which are missing such handling: - psql has one problem in get_create_object_cmd which misses twice to qualify array_remove(). - isolationtester is missing one for a call to pg_backend_pid() - information_schema.sql has one problem as well: the function _pg_interval_type does not qualify upper(). Please note that there is no need to care about view's bodies because those use OID references, so only the function body need to be taken care of. - worker_spi scans pg_namespace and uses count() without schema qualification. Attached is a patch which fixes all four of them, and which should be back-patched. For information_schema.sql, users can always replace the body of the function by redefining them (using SET search_path in CREATE FUNCTION would work as well however this is more costly than a simple qualification). Thoughts? -- Michael
Commits
-
Add some missing schema qualifications
- ee2b37ae044f 12.0 landed