pg.ddx.io pgsql-committers@postgresql.org mailing list archivehelp / color / mirror / Atom feed
pgsql: Avoid repeated table name lookups in createPartitionTable() 2+ messages / 1 participants [nested] [flat]
* pgsql: Avoid repeated table name lookups in createPartitionTable() @ 2024-08-22 06:51 Alexander Korotkov <akorotkov@postgresql.org> 0 siblings, 0 replies; 2+ messages in thread From: Alexander Korotkov @ 2024-08-22 06:51 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Avoid repeated table name lookups in createPartitionTable() Currently, createPartitionTable() opens newly created table using its name. This approach is prone to privilege escalation attack, because we might end up opening another table than we just created. This commit address the issue above by opening newly created table by its OID. It appears to be tricky to get a relation OID out of ProcessUtility(). We have to extend TableLikeClause with new newRelationOid field, which is filled within ProcessUtility() to be further accessed by caller. Security: CVE-2014-0062 Reported-by: Noah Misch Discussion: https://postgr.es/m/20240808171351.a9.nmisch%40google.com Reviewed-by: Pavel Borisov, Dmitry Koval Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/04158e7fa37c2dda9c3421ca922d02807b86df19 Modified Files -------------- src/backend/commands/tablecmds.c | 3 ++- src/backend/parser/gram.y | 1 + src/backend/tcop/utility.c | 6 ++++++ src/include/nodes/parsenodes.h | 1 + 4 files changed, 10 insertions(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 2+ messages in thread
* pgsql: Avoid repeated table name lookups in createPartitionTable() @ 2024-08-22 06:56 Alexander Korotkov <akorotkov@postgresql.org> 0 siblings, 0 replies; 2+ messages in thread From: Alexander Korotkov @ 2024-08-22 06:56 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Avoid repeated table name lookups in createPartitionTable() Currently, createPartitionTable() opens newly created table using its name. This approach is prone to privilege escalation attack, because we might end up opening another table than we just created. This commit address the issue above by opening newly created table by its OID. It appears to be tricky to get a relation OID out of ProcessUtility(). We have to extend TableLikeClause with new newRelationOid field, which is filled within ProcessUtility() to be further accessed by caller. Security: CVE-2014-0062 Reported-by: Noah Misch Discussion: https://postgr.es/m/20240808171351.a9.nmisch%40google.com Reviewed-by: Pavel Borisov, Dmitry Koval Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/f636ab41aba215eaa3303e21a10f12d81357f1f6 Modified Files -------------- src/backend/commands/tablecmds.c | 3 ++- src/backend/parser/gram.y | 1 + src/backend/tcop/utility.c | 6 ++++++ src/include/nodes/parsenodes.h | 1 + 4 files changed, 10 insertions(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2024-08-22 06:56 UTC | newest] Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2024-08-22 06:51 pgsql: Avoid repeated table name lookups in createPartitionTable() Alexander Korotkov <akorotkov@postgresql.org> 2024-08-22 06:56 pgsql: Avoid repeated table name lookups in createPartitionTable() Alexander Korotkov <akorotkov@postgresql.org>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox