pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedFrom: Laurenz Albe <laurenz.albe@cybertec.at>
To: theshallow27@gmail.com
To: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19740: `has_language_privilege` returns TRUE for a nonexistent language OID when the user is a superuser
Date: Sun, 04 Oct 2026 15:39:32 +0200
Message-ID: <c886cc0645ac17f6fe3d5b155e01d1be22bd6c97.camel@cybertec.at> (raw)
In-Reply-To: <19740-677922f8a0cc921c@postgresql.org>
References: <19740-677922f8a0cc921c@postgresql.org>
On Fri, 2026-10-02 at 22:38 +0000, PG Bug reporting form wrote:
> ostgreSQL version: 18.6
>
> For a nonexistent language OID, the implicit-current-user form returns TRUE
> when the current user is a superuser. An explicit non-superuser role returns
> NULL for the same missing OID. This makes the result depend on the role's
> superuser status even though the referenced language does not exist.
>
> **Reproduction:** Run as the default `postgres` superuser:
>
> ```sql
> SELECT NOT EXISTS (SELECT FROM pg_language WHERE oid = 0),
> has_language_privilege(0::oid, 'USAGE'),
> has_language_privilege('pg_monitor', 0::oid, 'USAGE');
> ```
>
> **Actual result:** `true | true | NULL`.
>
> **Expected result:** The privilege inquiry should return NULL for the
> missing
> language OID in both forms, matching the function's missing-object handling
> for non-superuser roles.
I agree that that is not so great. Since this behavior is in the function
object_aclcheck_ext(), which is used by all the has_*_privilege functions,
the same oddity affects all those functions.
I think that would be easy to change, but I wonder if it is a good idea.
That bug hardly hurts: has_language_privilege() is typically not what you
use to find out if a procedural language exists or not.
And perhaps there is a misguided script somewhere out there that would
suddenly start to misbehave if a superuser no longer is reported as having
all privileges on non-existing objects.
Is it a real problem for you?
Yours,
Laurenz Albe
view thread (2+ messages)
Message-ID: <c886cc0645ac17f6fe3d5b155e01d1be22bd6c97.camel@cybertec.at>
Permalink: ../c886cc0645ac17f6fe3d5b155e01d1be22bd6c97.camel@cybertec.at/
Also on: postgresql.org/message-id/c886cc0645ac17f6fe3d5b155e01d1be22bd6c97.camel@cybertec.at
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: laurenz.albe@cybertec.at, theshallow27@gmail.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19740: `has_language_privilege` returns TRUE for a nonexistent language OID when the user is a superuser
In-Reply-To: <c886cc0645ac17f6fe3d5b155e01d1be22bd6c97.camel@cybertec.at>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox