MIME-Version: 1.0
From: Vismay Tiwari <vismay.t@gmail.com>
Date: Thu, 9 Jul 2026 15:43:50 +0530
Message-ID: 
 <CALHMmB84qkCgv3QAR78YawgfqQZCxSPkRhppxzU=e6fg8RA+AA@mail.gmail.com>
Subject: Re: BUG #19523: psql tab-completion shadows pg_db_role_setting
To: pgsql-bugs@lists.postgresql.org
Content-Type: multipart/mixed; boundary="0000000000000d909306562ae269"
Archived-At: 
 <https://www.postgresql.org/message-id/CALHMmB84qkCgv3QAR78YawgfqQZCxSPkRhppxzU%3De6fg8RA%2BAA%40mail.gmail.com>
Precedence: bulk

--0000000000000d909306562ae269
Content-Type: text/plain; charset="UTF-8"

Hi,

Reproduced on current master. The tab-completion query for
"ALTER DATABASE ... RESET" (Query_for_list_of_database_vars) references
pg_db_role_setting and pg_database without a pg_catalog qualification, so a
same-named table earlier in search_path shadows the catalog:

    CREATE SCHEMA attacker;
    CREATE TABLE attacker.pg_db_role_setting (setdatabase oid, setrole
oid, setconfig text[]);
    INSERT INTO attacker.pg_db_role_setting
      SELECT oid, 0, ARRAY['evil_var=x'] FROM pg_database WHERE
datname = 'postgres';
    SET search_path = attacker, pg_catalog;
    -- "ALTER DATABASE postgres RESET <TAB>" then offers evil_var

The attached patch qualifies both catalogs with pg_catalog, matching the
qualification already used for unnest()/split_part() in the same query and for
the catalogs in the analogous subscription-variable completion query.

No test is included -- tab-completion query internals aren't covered by the
TAP suite, and this follows the earlier qualification fixes in the same area.
Affects v18 and master (the query was added in v18).

Regards,
Vismay Tiwari

--0000000000000d909306562ae269
Content-Type: application/octet-stream;
	name="v1-0001-psql-schema-qualify-catalog-references-in-a-tab-c.patch"
Content-Disposition: attachment;
	filename="v1-0001-psql-schema-qualify-catalog-references-in-a-tab-c.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mrdcms3z0>
X-Attachment-Id: f_mrdcms3z0

RnJvbSA0NTA3NzIzNzIwZjcxMDVjNWE1OGFiOWZkYTc3NjQwNWY3MDNiODEzIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiB2aXNtYXl0aXdhcmkgPHZpc21heS50QGdtYWlsLmNvbT4KRGF0
ZTogVGh1LCA5IEp1bCAyMDI2IDE1OjM1OjUxICswNTMwClN1YmplY3Q6IFtQQVRDSCB2MV0gcHNx
bDogc2NoZW1hLXF1YWxpZnkgY2F0YWxvZyByZWZlcmVuY2VzIGluIGEKIHRhYi1jb21wbGV0aW9u
IHF1ZXJ5CgpUaGUgdGFiLWNvbXBsZXRpb24gcXVlcnkgYmVoaW5kIFF1ZXJ5X2Zvcl9saXN0X29m
X2RhdGFiYXNlX3ZhcnMgcmVmZXJlbmNlZApwZ19kYl9yb2xlX3NldHRpbmcgYW5kIHBnX2RhdGFi
YXNlIHdpdGhvdXQgc2NoZW1hIHF1YWxpZmljYXRpb24uICBBIHRhYmxlIG9mCnRoZSBzYW1lIG5h
bWUgZWFybGllciBpbiB0aGUgdXNlcidzIHNlYXJjaF9wYXRoIHRoZXJlZm9yZSBzaGFkb3dzIHRo
ZSBjYXRhbG9nCmFuZCBmZWVkcyBhcmJpdHJhcnkgdmFsdWVzIGludG8gdGhlIGNvbXBsZXRpb24g
c3VnZ2VzdGlvbnMgZm9yCiJBTFRFUiBEQVRBQkFTRSAuLi4gUkVTRVQiLiAgUXVhbGlmeSBib3Ro
IHdpdGggcGdfY2F0YWxvZywgbWF0Y2hpbmcgdGhlCnF1YWxpZmljYXRpb24gYWxyZWFkeSBhcHBs
aWVkIHRvIHVubmVzdCgpL3NwbGl0X3BhcnQoKSBpbiB0aGlzIHNhbWUgcXVlcnkgYW5kCnRvIHRo
ZSBjYXRhbG9ncyBpbiB0aGUgYW5hbG9nb3VzIHN1YnNjcmlwdGlvbi12YXJpYWJsZSBjb21wbGV0
aW9uIHF1ZXJ5LgoKUmVwb3J0ZWQtYnk6IFpob3UgRGlnb2FsCkJ1ZzogIzE5NTIzCkRpc2N1c3Np
b246IGh0dHBzOi8vcG9zdGdyLmVzL20vMTk1MjMtNDI0NDU3MTE4MjAyZjU3MEBwb3N0Z3Jlc3Fs
Lm9yZwotLS0KIHNyYy9iaW4vcHNxbC90YWItY29tcGxldGUuaW4uYyB8IDQgKystLQogMSBmaWxl
IGNoYW5nZWQsIDIgaW5zZXJ0aW9ucygrKSwgMiBkZWxldGlvbnMoLSkKCmRpZmYgLS1naXQgYS9z
cmMvYmluL3BzcWwvdGFiLWNvbXBsZXRlLmluLmMgYi9zcmMvYmluL3BzcWwvdGFiLWNvbXBsZXRl
LmluLmMKaW5kZXggNDllYTU4NC4uNmE4ODQ3MCAxMDA2NDQKLS0tIGEvc3JjL2Jpbi9wc3FsL3Rh
Yi1jb21wbGV0ZS5pbi5jCisrKyBiL3NyYy9iaW4vcHNxbC90YWItY29tcGxldGUuaW4uYwpAQCAt
MTA0MCw4ICsxMDQwLDggQEAgc3RhdGljIGNvbnN0IFNjaGVtYVF1ZXJ5IFF1ZXJ5X2Zvcl90cmln
Z2VyX29mX3RhYmxlID0gewogI2RlZmluZSBRdWVyeV9mb3JfbGlzdF9vZl9kYXRhYmFzZV92YXJz
IFwKICJTRUxFQ1QgY29uZiBGUk9NICgiXAogIiAgICAgICBTRUxFQ1Qgc2V0ZGF0YWJhc2UsIHBn
X2NhdGFsb2cuc3BsaXRfcGFydChwZ19jYXRhbG9nLnVubmVzdChzZXRjb25maWcpLCc9JywxKSBj
b25mIlwKLSIgICAgICAgICBGUk9NIHBnX2RiX3JvbGVfc2V0dGluZyAiXAotIiAgICAgICApIHMs
IHBnX2RhdGFiYXNlIGQgIlwKKyIgICAgICAgICBGUk9NIHBnX2NhdGFsb2cucGdfZGJfcm9sZV9z
ZXR0aW5nICJcCisiICAgICAgICkgcywgcGdfY2F0YWxvZy5wZ19kYXRhYmFzZSBkICJcCiAiIFdI
RVJFIHMuc2V0ZGF0YWJhc2UgPSBkLm9pZCAiXAogIiAgIEFORCBjb25mIExJS0UgJyVzJyJcCiAi
ICAgQU5EIGQuZGF0bmFtZSBMSUtFICclcyciCi0tIAoyLjUwLjEgKEFwcGxlIEdpdC0xNTUpCgo=
--0000000000000d909306562ae269--