MIME-Version: 1.0
References: 
 <CALHMmB84qkCgv3QAR78YawgfqQZCxSPkRhppxzU=e6fg8RA+AA@mail.gmail.com>
In-Reply-To: 
 <CALHMmB84qkCgv3QAR78YawgfqQZCxSPkRhppxzU=e6fg8RA+AA@mail.gmail.com>
From: Kirill Reshke <reshkekirill@gmail.com>
Date: Fri, 10 Jul 2026 09:49:10 +0500
Message-ID: 
 <CALdSSPiAmy3ZoUyRXMqFazm0D0b1Y4oMhUKVpXwSBhrDh+odew@mail.gmail.com>
Subject: Re: BUG #19523: psql tab-completion shadows pg_db_role_setting
To: Vismay Tiwari <vismay.t@gmail.com>
Cc: PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000d0f14706563a76de"
Archived-At: 
 <https://www.postgresql.org/message-id/CALdSSPiAmy3ZoUyRXMqFazm0D0b1Y4oMhUKVpXwSBhrDh%2Bodew%40mail.gmail.com>
Precedence: bulk

--000000000000d0f14706563a76de
Content-Type: text/plain; charset="UTF-8"

Hi! You seem to create two threads on the issue, so I don't quite
understand where to respond. anyway:

On Thu, 9 Jul 2026, 15:14 Vismay Tiwari, <vismay.t@gmail.com> wrote:

> Hi,
>
> Reproduced on current master. The tab-completion query for
> "ALTER DATABASE ... RESET" (Query_for_list_of_database_vars) references
> pg_db_role_setting and pg_database without a pg_catalog qualification, so a
> same-named table earlier in search_path shadows the catalog:
>
>     CREATE SCHEMA attacker;
>     CREATE TABLE attacker.pg_db_role_setting (setdatabase oid, setrole
> oid, setconfig text[]);
>     INSERT INTO attacker.pg_db_role_setting
>       SELECT oid, 0, ARRAY['evil_var=x'] FROM pg_database WHERE
> datname = 'postgres';
>     SET search_path = attacker, pg_catalog;
>     -- "ALTER DATABASE postgres RESET <TAB>" then offers evil_var
>
>
Preventing this makes sense in case somebody accidentally misconfigured
their server. Which is not very probable for a table with `
pg_db_role_setting` name.
Also note that this is not a vulnerability: from
https://www.postgresql.org/docs/current/app-psql.html says:

  If untrusted users have access to a database that has not adopted a secure
  schema usage pattern, begin your session by removing publicly-writable
  schemas from search_path.

Anyway +1 on fixing

--000000000000d0f14706563a76de
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><div dir=3D"auto"><div>Hi! You =
seem to create two threads on the issue, so I don&#39;t=C2=A0quite understa=
nd where=C2=A0to respond. anyway:<br><br><div class=3D"gmail_quote"><div di=
r=3D"ltr" class=3D"gmail_attr">On Thu, 9 Jul 2026, 15:14 Vismay Tiwari, &lt=
;<a href=3D"mailto:vismay.t@gmail.com" target=3D"_blank">vismay.t@gmail.com=
</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:=
0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">=
Hi,<br>
<br>
Reproduced on current master. The tab-completion query for<br>
&quot;ALTER DATABASE ... RESET&quot; (Query_for_list_of_database_vars) refe=
rences<br>
pg_db_role_setting and pg_database without a pg_catalog qualification, so a=
<br>
same-named table earlier in search_path shadows the catalog:<br>
<br>
=C2=A0 =C2=A0 CREATE SCHEMA attacker;<br>
=C2=A0 =C2=A0 CREATE TABLE attacker.pg_db_role_setting (setdatabase oid, se=
trole<br>
oid, setconfig text[]);<br>
=C2=A0 =C2=A0 INSERT INTO attacker.pg_db_role_setting<br>
=C2=A0 =C2=A0 =C2=A0 SELECT oid, 0, ARRAY[&#39;evil_var=3Dx&#39;] FROM pg_d=
atabase WHERE<br>
datname =3D &#39;postgres&#39;;<br>
=C2=A0 =C2=A0 SET search_path =3D attacker, pg_catalog;<br>
=C2=A0 =C2=A0 -- &quot;ALTER DATABASE postgres RESET &lt;TAB&gt;&quot; then=
 offers evil_var<br>
<br></blockquote><div class=3D"gmail_quote"><br></div>Preventing this makes=
 sense=C2=A0in case somebody=C2=A0accidentally=C2=A0misconfigured their ser=
ver. Which is not very probable=C2=A0for a table with `<span style=3D"backg=
round-color:transparent">pg_db_role_setting</span><span style=3D"background=
-color:transparent">` name.</span></div><div class=3D"gmail_quote">Also not=
e that this is not a vulnerability: from <a href=3D"https://www.postgresql.=
org/docs/current/app-psql.html">https://www.postgresql.org/docs/current/app=
-psql.html</a> says:<br><br>=C2=A0 If untrusted users have access to a data=
base that has not adopted a secure<br>=C2=A0 schema usage pattern, begin yo=
ur session by removing publicly-writable<br>=C2=A0 schemas from search_path=
.</div><div class=3D"gmail_quote"><br></div><div class=3D"gmail_quote">Anyw=
ay=C2=A0+1 on fixing</div><div class=3D"gmail_quote"><br><div>=C2=A0</div><=
/div></div></div>
</div>

--000000000000d0f14706563a76de--