From 88743d581e1bdedc13e4ca33c5a6597a5d2dbdc4 Mon Sep 17 00:00:00 2001 From: Noah Misch Date: Mon, 9 May 2022 08:35:08 -0700 Subject: In REFRESH MATERIALIZED VIEW, set user ID before running user code. It intended to, but did not, achieve this. Adopt the new standard of setting user ID just after locking the relation. Back-patch to v10 (all supported versions). Reviewed by Simon Riggs. Reported by Alvaro Herrera. Security: CVE-2022-1552 --- src/backend/commands/matview.c | 30 +++++++++++------------------- 1 file changed, 11 insertions(+), 19 deletions(-) (limited to 'src/backend/commands/matview.c') diff --git a/src/backend/commands/matview.c b/src/backend/commands/matview.c index 2ba5172f7c6..b1fa88d88a1 100644 --- a/src/backend/commands/matview.c +++ b/src/backend/commands/matview.c @@ -167,6 +167,17 @@ ExecRefreshMatView(RefreshMatViewStmt *stmt, const char *queryString, lockmode, 0, RangeVarCallbackOwnsTable, NULL); matviewRel = table_open(matviewOid, NoLock); + relowner = matviewRel->rd_rel->relowner; + + /* + * Switch to the owner's userid, so that any functions are run as that + * user. Also lock down security-restricted operations and arrange to + * make GUC variable changes local to this command. + */ + GetUserIdAndSecContext(&save_userid, &save_sec_context); + SetUserIdAndSecContext(relowner, + save_sec_context | SECURITY_RESTRICTED_OPERATION); + save_nestlevel = NewGUCNestLevel(); /* Make sure it is a materialized view. */ if (matviewRel->rd_rel->relkind != RELKIND_MATVIEW) @@ -269,19 +280,6 @@ ExecRefreshMatView(RefreshMatViewStmt *stmt, const char *queryString, */ SetMatViewPopulatedState(matviewRel, !stmt->skipData); - relowner = matviewRel->rd_rel->relowner; - - /* - * Switch to the owner's userid, so that any functions are run as that - * user. Also arrange to make GUC variable changes local to this command. - * Don't lock it down too tight to create a temporary table just yet. We - * will switch modes when we are about to execute user code. - */ - GetUserIdAndSecContext(&save_userid, &save_sec_context); - SetUserIdAndSecContext(relowner, - save_sec_context | SECURITY_LOCAL_USERID_CHANGE); - save_nestlevel = NewGUCNestLevel(); - /* Concurrent refresh builds new data in temp tablespace, and does diff. */ if (concurrent) { @@ -304,12 +302,6 @@ ExecRefreshMatView(RefreshMatViewStmt *stmt, const char *queryString, LockRelationOid(OIDNewHeap, AccessExclusiveLock); dest = CreateTransientRelDestReceiver(OIDNewHeap); - /* - * Now lock down security-restricted operations. - */ - SetUserIdAndSecContext(relowner, - save_sec_context | SECURITY_RESTRICTED_OPERATION); - /* Generate the data, if wanted. */ if (!stmt->skipData) processed = refresh_matview_datafill(dest, dataQuery, queryString); -- cgit v1.2.3