postgres.git / summary / log / commit / refs

commit    44ea6764be76ebb3d8dd01d60b5751acbe7b87d3
Author:   Nathan Bossart <nathan@postgresql.org>
Commit:   Noah Misch <noah@leadboat.com>
Date:     Mon Aug 10 13:38:30 2026 +0000

    Obstruct EXTRACT() field name deparse injection.
    
    The parser accepts any string as an EXTRACT() field name, but
    deparsing does not quote and escape it accordingly.  To fix, quote
    and escape the field name during deparsing as needed.  It might be
    a good idea to validate the field name during parsing and
    deparsing, too, but that is left as a future exercise.
    
    Reported-by: Ben Morris in collaboration with Claude and Anthropic Research
    Author: Nathan Bossart <nathandbossart@gmail.com>
    Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
    Reviewed-by: Etsuro Fujita <etsuro.fujita@gmail.com>
    Security: CVE-2026-15741
    Backpatch-through: 14


 src/backend/utils/adt/ruleutils.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/backend/utils/adt/ruleutils.c b/src/backend/utils/adt/ruleutils.c
index 59c9fba3827..b4424db01c3 100644
--- a/src/backend/utils/adt/ruleutils.c
+++ b/src/backend/utils/adt/ruleutils.c
@@ -10363,7 +10363,7 @@ get_func_sql_syntax(FuncExpr *expr, deparse_context *context)
 				Assert(IsA(con, Const) &&
 					   con->consttype == TEXTOID &&
 					   !con->constisnull);
-				appendStringInfoString(buf, TextDatumGetCString(con->constvalue));
+				appendStringInfoString(buf, quote_identifier(TextDatumGetCString(con->constvalue)));
 			}
 			appendStringInfoString(buf, " FROM ");
 			get_rule_expr((Node *) lsecond(expr->args), context, false);
@@ -10383,6 +10383,7 @@ get_func_sql_syntax(FuncExpr *expr, deparse_context *context)
 				Assert(IsA(con, Const) &&
 					   con->consttype == TEXTOID &&
 					   !con->constisnull);
+				/* NB: safe because no allowed words need quoted/escaped */
 				appendStringInfo(buf, " %s",
 								 TextDatumGetCString(con->constvalue));
 			}


[parent: 5737110b60af]