From ff06716e3dafc73820ed38f6eea2c6d6dcae7fd9 Mon Sep 17 00:00:00 2001 From: Heikki Linnakangas Date: Wed, 30 Jun 2010 18:10:37 +0000 Subject: stringToNode() and deparse_expression_pretty() crash on invalid input, but we have nevertheless exposed them to users via pg_get_expr(). It would be too much maintenance effort to rigorously check the input, so put a hack in place instead to restrict pg_get_expr() so that the argument must come from one of the system catalog columns known to contain valid expressions. Per report from Rushabh Lathia. Backpatch to 7.4 which is the oldest supported version at the moment. --- src/backend/tcop/fastpath.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) (limited to 'src/backend/tcop/fastpath.c') diff --git a/src/backend/tcop/fastpath.c b/src/backend/tcop/fastpath.c index e8ec1177652..96519f638d8 100644 --- a/src/backend/tcop/fastpath.c +++ b/src/backend/tcop/fastpath.c @@ -8,7 +8,7 @@ * * * IDENTIFICATION - * $PostgreSQL: pgsql/src/backend/tcop/fastpath.c,v 1.101 2009/01/01 17:23:48 momjian Exp $ + * $PostgreSQL: pgsql/src/backend/tcop/fastpath.c,v 1.101.2.1 2010/06/30 18:10:37 heikki Exp $ * * NOTES * This cruft is the server side of PQfn. @@ -29,6 +29,7 @@ #include "tcop/fastpath.h" #include "tcop/tcopprot.h" #include "utils/acl.h" +#include "utils/fmgroids.h" #include "utils/lsyscache.h" #include "utils/snapmgr.h" #include "utils/syscache.h" @@ -349,6 +350,16 @@ HandleFunctionRequest(StringInfo msgBuf) aclcheck_error(aclresult, ACL_KIND_PROC, get_func_name(fid)); + /* + * Restrict access to pg_get_expr(). This reflects the hack in + * transformFuncCall() in parse_expr.c, see comments there for an + * explanation. + */ + if ((fid == F_PG_GET_EXPR || fid == F_PG_GET_EXPR_EXT) && !superuser()) + ereport(ERROR, + (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), + errmsg("argument to pg_get_expr() must come from system catalogs"))); + /* * Prepare function call info block and insert arguments. */ -- cgit v1.2.3