postgres

History

Dean Rasheed afe38fb6ab Fix security checks in selectivity estimation functions. Commit `e2d4ef8de8` (the fix for CVE-2017-7484) added security checks to the selectivity estimation functions to prevent them from running user-supplied operators on data obtained from pg_statistic if the user lacks privileges to select from the underlying table. In cases involving inheritance/partitioning, those checks were originally performed against the child RTE (which for plain inheritance might actually refer to the parent table). Commit `553d2ec271` then extended that to also check the parent RTE, allowing access if the user had permissions on either the parent or the child. It turns out, however, that doing any checks using the child RTE is incorrect, since securityQuals is set to NULL when creating an RTE for an inheritance child (whether it refers to the parent table or the child table), and therefore such checks do not correctly account for any RLS policies or security barrier views. Therefore, do the security checks using only the parent RTE. This is consistent with how RLS policies are applied, and the executor's ACL checks, both of which use only the parent table's permissions/policies. Similar checks are performed in the extended stats code, so update that in the same way, centralizing all the checks in a new function. In addition, note that these checks by themselves are insufficient to ensure that the user has access to the table's data because, in a query that goes via a view, they only check that the view owner has permissions on the underlying table, not that the current user has permissions on the view itself. In the selectivity estimation functions, there is no easy way to navigate from underlying tables to views, so add permissions checks for all views mentioned in the query to the planner startup code. If the user lacks permissions on a view, a permissions error will now be reported at planner-startup, and the selectivity estimation functions will not be run. Checking view permissions at planner-startup in this way is a little ugly, since the same checks will be repeated at executor-startup. Longer-term, it might be better to move all the permissions checks from the executor to the planner so that permissions errors can be reported sooner, instead of creating a plan that won't ever be run. However, such a change seems too far-reaching to be back-patched. Back-patch to all supported versions. In v13, there is the added complication that UPDATEs and DELETEs on inherited target tables are planned using inheritance_planner(), which plans each inheritance child table separately, so that the selectivity estimation functions do not know that they are dealing with a child table accessed via its parent. Handle that by checking access permissions on the top parent table at planner-startup, in the same way as we do for views. Any securityQuals on the top parent table are moved down to the child tables by inheritance_planner(), so they continue to be checked by the selectivity estimation functions. Author: Dean Rasheed <dean.a.rasheed@gmail.com> Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Noah Misch <noah@leadboat.com> Backpatch-through: 13 Security: CVE-2025-8713		5 months ago
..
backend	Fix security checks in selectivity estimation functions.	5 months ago
bin	Remove, from stable branches, the new assertion of no pg_dump OID sort.	5 months ago
common	With GB18030, prevent SIGSEGV from reading past end of allocation.	8 months ago
fe_utils	In fmtIdEnc(), handle failure of enlargePQExpBuffer().	11 months ago
include	Fix security checks in selectivity estimation functions.	5 months ago
interfaces	Don't put library-supplied -L/-I switches before user-supplied ones.	6 months ago
makefiles	…
pl	Don't put library-supplied -L/-I switches before user-supplied ones.	6 months ago
port	Make our usage of memset_s() conform strictly to the C11 standard.	8 months ago
template	…
test	Fix security checks in selectivity estimation functions.	5 months ago
timezone	Update time zone data files to tzdata release 2025b.	9 months ago
tools	Make our usage of memset_s() conform strictly to the C11 standard.	8 months ago
tutorial	…
.gitignore	…
DEVELOPERS	…
Makefile	…
Makefile.global.in	Don't put library-supplied -L/-I switches before user-supplied ones.	6 months ago
Makefile.shlib	…
nls-global.mk	…