diff options
| author | Noah Misch <noah@leadboat.com> | 2020-11-09 07:32:09 -0800 |
|---|---|---|
| committer | Noah Misch <noah@leadboat.com> | 2020-11-09 07:32:09 -0800 |
| commit | 098fb00799ffb026ff12c64bd21635f963cfc609 (patch) | |
| tree | 85459aab4bb940c798d8dd2600500f461135cc76 /src/test | |
| parent | 0c3185e963d9f9dd0608214f7d732b84aa0888fe (diff) | |
Ignore attempts to \gset into specially treated variables.
If an interactive psql session used \gset when querying a compromised
server, the attacker could execute arbitrary code as the operating
system account running psql. Using a prefix not found among specially
treated variables, e.g. every lowercase string, precluded the attack.
Fix by issuing a warning and setting no variable for the column in
question. Users wanting the old behavior can use a prefix and then a
meta-command like "\set HISTSIZE :prefix_HISTSIZE". Back-patch to 9.5
(all supported versions).
Reviewed by Robert Haas. Reported by Nick Cleaton.
Security: CVE-2020-25696
Diffstat (limited to 'src/test')
| -rw-r--r-- | src/test/regress/expected/psql.out | 4 | ||||
| -rw-r--r-- | src/test/regress/sql/psql.sql | 3 |
2 files changed, 7 insertions, 0 deletions
diff --git a/src/test/regress/expected/psql.out b/src/test/regress/expected/psql.out index daac0ff49d6..7204fdb0b43 100644 --- a/src/test/regress/expected/psql.out +++ b/src/test/regress/expected/psql.out @@ -106,6 +106,10 @@ select 10 as test01, 20 as test02, 'Hello' as test03 \gset pref01_ select 10 as "bad name" \gset invalid variable name: "bad name" +select 97 as "EOF", 'ok' as _foo \gset IGNORE +attempt to \gset into specially treated variable "IGNOREEOF" ignored +\echo :IGNORE_foo :IGNOREEOF +ok 0 -- multiple backslash commands in one line select 1 as x, 2 as y \gset pref01_ \\ \echo :pref01_x 1 diff --git a/src/test/regress/sql/psql.sql b/src/test/regress/sql/psql.sql index 47b28d2a076..537d5332aa9 100644 --- a/src/test/regress/sql/psql.sql +++ b/src/test/regress/sql/psql.sql @@ -55,6 +55,9 @@ select 10 as test01, 20 as test02, 'Hello' as test03 \gset pref01_ select 10 as "bad name" \gset +select 97 as "EOF", 'ok' as _foo \gset IGNORE +\echo :IGNORE_foo :IGNOREEOF + -- multiple backslash commands in one line select 1 as x, 2 as y \gset pref01_ \\ \echo :pref01_x select 3 as x, 4 as y \gset pref01_ \echo :pref01_x \echo :pref01_y |