public inbox for [email protected]  

help / color / mirror / Atom feed

From: Kirill Reshke <[email protected]>
To: Vismay Tiwari <[email protected]>
Cc: PostgreSQL mailing lists <[email protected]>
Subject: Re: BUG #19523: psql tab-completion shadows pg_db_role_setting
Date: Fri, 10 Jul 2026 09:49:10 +0500
Message-ID: <CALdSSPiAmy3ZoUyRXMqFazm0D0b1Y4oMhUKVpXwSBhrDh+odew@mail.gmail.com> (raw)
In-Reply-To: <CALHMmB84qkCgv3QAR78YawgfqQZCxSPkRhppxzU=e6fg8RA+AA@mail.gmail.com>
References: <CALHMmB84qkCgv3QAR78YawgfqQZCxSPkRhppxzU=e6fg8RA+AA@mail.gmail.com>

Hi! You seem to create two threads on the issue, so I don't quite
understand where to respond. anyway:

On Thu, 9 Jul 2026, 15:14 Vismay Tiwari, <[email protected]> wrote:

> Hi,
>
> Reproduced on current master. The tab-completion query for
> "ALTER DATABASE ... RESET" (Query_for_list_of_database_vars) references
> pg_db_role_setting and pg_database without a pg_catalog qualification, so a
> same-named table earlier in search_path shadows the catalog:
>
>     CREATE SCHEMA attacker;
>     CREATE TABLE attacker.pg_db_role_setting (setdatabase oid, setrole
> oid, setconfig text[]);
>     INSERT INTO attacker.pg_db_role_setting
>       SELECT oid, 0, ARRAY['evil_var=x'] FROM pg_database WHERE
> datname = 'postgres';
>     SET search_path = attacker, pg_catalog;
>     -- "ALTER DATABASE postgres RESET <TAB>" then offers evil_var
>
>
Preventing this makes sense in case somebody accidentally misconfigured
their server. Which is not very probable for a table with `
pg_db_role_setting` name.
Also note that this is not a vulnerability: from
https://www.postgresql.org/docs/current/app-psql.html says:

  If untrusted users have access to a database that has not adopted a secure
  schema usage pattern, begin your session by removing publicly-writable
  schemas from search_path.

Anyway +1 on fixing

view thread (4+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: BUG #19523: psql tab-completion shadows pg_db_role_setting
  In-Reply-To: <CALdSSPiAmy3ZoUyRXMqFazm0D0b1Y4oMhUKVpXwSBhrDh+odew@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox