postgres.git / summary / log / commit / refs
commit 5981fe370a0d433429977ff6fc420064cf2fa09a
Author: Nathan Bossart <nathan@postgresql.org>
Commit: Noah Misch <noah@leadboat.com>
Date: Mon Aug 10 13:38:18 2026 +0000
First released in: 14.24, 15.19, 16.15, 17.11, 18.6
Obstruct EXTRACT() field name deparse injection.
The parser accepts any string as an EXTRACT() field name, but
deparsing does not quote and escape it accordingly. To fix, quote
and escape the field name during deparsing as needed. It might be
a good idea to validate the field name during parsing and
deparsing, too, but that is left as a future exercise.
Reported-by: Ben Morris in collaboration with Claude and Anthropic Research
Author: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Etsuro Fujita <etsuro.fujita@gmail.com>
Security: CVE-2026-15741
Backpatch-through: 14
src/backend/utils/adt/ruleutils.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/backend/utils/adt/ruleutils.c b/src/backend/utils/adt/ruleutils.c
index 71d1896b67e..929d59ac9e4 100644
--- a/src/backend/utils/adt/ruleutils.c
+++ b/src/backend/utils/adt/ruleutils.c
@@ -10890,7 +10890,7 @@ get_func_sql_syntax(FuncExpr *expr, deparse_context *context)
Assert(IsA(con, Const) &&
con->consttype == TEXTOID &&
!con->constisnull);
- appendStringInfoString(buf, TextDatumGetCString(con->constvalue));
+ appendStringInfoString(buf, quote_identifier(TextDatumGetCString(con->constvalue)));
}
appendStringInfoString(buf, " FROM ");
get_rule_expr((Node *) lsecond(expr->args), context, false);
@@ -10910,6 +10910,7 @@ get_func_sql_syntax(FuncExpr *expr, deparse_context *context)
Assert(IsA(con, Const) &&
con->consttype == TEXTOID &&
!con->constisnull);
+ /* NB: safe because no allowed words need quoted/escaped */
appendStringInfo(buf, " %s",
TextDatumGetCString(con->constvalue));
}
[parent: 067a64d40f92]