Re: pg18: Virtual generated columns are not (yet) safe when superuser selects from them

jian he <jian.universality@gmail.com>

From: jian he <jian.universality@gmail.com>

To: Feike Steenbergen <feikesteenbergen@gmail.com>

Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>

Date: 2025-05-24T13:42:31Z

Lists: pgsql-hackers

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

Restrict virtual columns to use built-in functions and types
- 0cd69b3d7ef3 18.0 landed
Fix virtual generated column type checking for ALTER TABLE
- 49fe1c83ecf3 18.0 landed
Expand virtual generated columns in the planner
- 1e4351af329f 18.0 cited

On Sat, May 24, 2025 at 2:39 PM Feike Steenbergen
<feikesteenbergen@gmail.com> wrote:
>
> The loophole is this:
>
> - the generated virtual column can use a user-defined function
> - when running SELECT against that column by a superuser
>   the function is called within the context of a superuser
> - this in turn allows the regular user to run any code within
>   the context of superuser

sorry, I am not fully sure what this means.
a minimum sql reproducer would be great.

you may check virtual generated column function privilege regress tests on
https://git.postgresql.org/cgit/postgresql.git/tree/src/test/regress/sql/generated_virtual.sql#n284
(from line 284 to line 303)

also see [1].
PostgreSQL grants EXECUTE privilege for functions and procedures to
PUBLIC *by default* when the objects are created.

[1]: https://www.postgresql.org/docs/current/ddl-priv.html#PRIVILEGES-SUMMARY-TABLE