diff options
| author | Noah Misch <noah@leadboat.com> | 2020-11-09 07:32:09 -0800 |
|---|---|---|
| committer | Noah Misch <noah@leadboat.com> | 2020-11-09 07:32:14 -0800 |
| commit | a54dfbee1f1bad431793968918bbb8541dc860a0 (patch) | |
| tree | 777163b0cb9cdd45bf06c8b773f9b74a0198e353 /src/bin/psql/variables.c | |
| parent | aefc625dedae52073e7d279feb43f6255f992ea7 (diff) | |
Ignore attempts to \gset into specially treated variables.
If an interactive psql session used \gset when querying a compromised
server, the attacker could execute arbitrary code as the operating
system account running psql. Using a prefix not found among specially
treated variables, e.g. every lowercase string, precluded the attack.
Fix by issuing a warning and setting no variable for the column in
question. Users wanting the old behavior can use a prefix and then a
meta-command like "\set HISTSIZE :prefix_HISTSIZE". Back-patch to 9.5
(all supported versions).
Reviewed by Robert Haas. Reported by Nick Cleaton.
Security: CVE-2020-25696
Diffstat (limited to 'src/bin/psql/variables.c')
| -rw-r--r-- | src/bin/psql/variables.c | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/src/bin/psql/variables.c b/src/bin/psql/variables.c index b9a3dfad331..03d218ea129 100644 --- a/src/bin/psql/variables.c +++ b/src/bin/psql/variables.c @@ -264,6 +264,24 @@ SetVariableAssignHook(VariableSpace space, const char *name, VariableAssignHook return true; } +/* + * Return true iff the named variable has an assign hook function. + */ +bool +VariableHasHook(VariableSpace space, const char *name) +{ + struct _variable *current; + + Assert(space); + Assert(name); + + for (current = space->next; current; current = current->next) + if (strcmp(current->name, name) == 0) + return current->assign_hook != NULL; + + return false; +} + bool SetVariableBool(VariableSpace space, const char *name) { |