Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Subject: BUG #19523: psql tab-completion shadows pg_db_role_setting
To: pgsql-bugs@lists.postgresql.org
From: PG Bug reporting form <noreply@postgresql.org>
Cc: digoal@126.com
Reply-To: digoal@126.com, pgsql-bugs@lists.postgresql.org
Date: Thu, 18 Jun 2026 07:06:44 +0000
Message-ID: <19523-424457118202f570@postgresql.org>
Auto-Submitted: auto-generated
Archived-At: 
 <https://www.postgresql.org/message-id/19523-424457118202f570%40postgresql.org>
Precedence: bulk

The following bug has been logged on the website:

Bug reference:      19523
Logged by:          Zhou Digoal
Email address:      digoal@126.com
PostgreSQL version: 19beta1
Operating system:   macOS
Description:       =20

# =F0=9F=90=9B [BUG] psql tab-completion shadows pg_db_role_setting


## Environment

| Item | Value |
| --- | --- |
| OS | macOS 15.7.7 (build 24G720) |
| Kernel | Darwin 24.6.0 |
| Compiler | Apple clang version 17.0.0 (clang-1700.6.4.2) |
| PG version | 19beta1 (`pg_config --version`) |
| Source branch | `master` |
| Source commit | `850b9218c8e4aa7a56f4ec34a542d4a37f9e07eb` |
| `git describe` | `850b921` |
| Build flags | `--enable-debug --enable-cassert --enable-debug-symbols` |
| Configure | `$PGBIN/pg_config --configure` |

---

## Summary

The query that psql tab-completion runs to list database-scoped GUC names
(Query_for_list_of_database_vars in src/bin/psql/tab-complete.c, duplicated
in src/bin/psql/tab-complete.in.c) references the system catalog table
pg_db_role_setting without the pg_catalog. schema qualifier. A user with
CREATE privilege on any schema earlier in search_path than pg_catalog can
therefore shadow the catalog table and influence tab-completion suggestions
for ALTER DATABASE SET.


---

## Commit under test

`850b9218c8e4aa7a56f4ec34a542d4a37f9e07eb` on branch `master`. The full
source HEAD at report
time is `850b9218c8e4aa7a56f4ec34a542d4a37f9e07eb` (`git describe` =E2=86=92
`850b921`).

---

## Reproduction

Repro file: `/tmp/repro_pg_db_role_setting.sql`

```sql
CREATE SCHEMA attacker;
CREATE TABLE attacker.pg_db_role_setting (
    setdatabase oid,
    setrole     oid,
    setconfig   text[]
);
INSERT INTO attacker.pg_db_role_setting
SELECT oid, 0, ARRAY['custom_var=3Dvalue', 'session_replication_role=3Drepl=
ica']
  FROM pg_database WHERE datname =3D 'postgres';
SET search_path =3D attacker, pg_catalog;
SELECT conf FROM (
       SELECT setdatabase,
pg_catalog.split_part(pg_catalog.unnest(setconfig),'=3D',1) conf
         FROM pg_db_role_setting
       ) s, pg_database d
 WHERE s.setdatabase =3D d.oid
   AND conf LIKE 'c%'
   AND d.datname LIKE 'p%';
RESET search_path;
DROP SCHEMA attacker CASCADE;
```

### Actual output

```
Returned one row 'custom_var' that was read from attacker.pg_db_role_setting
rather than from the system catalog (which is empty for this database).
```

### Server log (last lines)

```
CREATE SCHEMA attacker;
CREATE SCHEMA
CREATE TABLE attacker.pg_db_role_setting (
    setdatabase oid,
    setrole     oid,
    setconfig   text[]
);
CREATE TABLE
INSERT INTO attacker.pg_db_role_setting
SELECT oid, 0, ARRAY['custom_var=3Dvalue', 'session_replication_role=3Drepl=
ica']
  FROM pg_database WHERE datname =3D 'postgres';
INSERT 0 1
SET search_path =3D attacker, pg_catalog;
SET
SELECT conf FROM (
       SELECT setdatabase,
pg_catalog.split_part(pg_catalog.unnest(setconfig),'=3D',1) conf
         FROM pg_db_role_setting
       ) s, pg_database d
 WHERE s.setdatabase =3D d.oid
   AND conf LIKE 'c%'
   AND d.datname LIKE 'p%';
    conf
------------
 custom_var
(1 row)

RESET search_path;
RESET
DROP SCHEMA attacker CASCADE;
psql:/tmp/repro_pg_db_role_setting.sql:48: NOTICE:  drop cascades to table
attacker.pg_db_role_setting
DROP SCHEMA
```


### Expected output

```
Zero rows; the query should resolve pg_db_role_setting to the system catalog
table regardless of search_path.
```

---

## Why is this a bug?

Commit bf5206f (psql: Add some missing schema qualifications in describe.c)
fixed the same class of bug for describe.c but missed tab-complete.c and
tab-complete.in.c. A user who can create a table named pg_db_role_setting in
a schema that appears before pg_catalog in search_path can have psql issue
its tab-completion query against the shadow table instead of the real
catalog, returning attacker- controlled GUC names. This violates the
documented psql behavior of suggesting actual database-level GUC settings.


---

## Suggested fix

Qualify the reference in src/bin/psql/tab-complete.in.c (line 1043) and the
generated src/bin/psql/tab-complete.c (line 1064) by changing FROM
pg_db_role_setting to FROM pg_catalog.pg_db_role_setting, then regenerate
tab-complete.c on rebuild.


---

## Severity

**medium** =E2=80=94 see Environment block.