From: Peter Eisentraut <peter@eisentraut.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Restrict virtual columns to use built-in functions and types
Date: Wed, 25 Jun 2025 08:02:18 +0000
Message-ID: <E1uUL5G-003Fl7-1P@gemulon.postgresql.org> (raw)
Restrict virtual columns to use built-in functions and types
Just like selecting from a view is exploitable (CVE-2024-7348),
selecting from a table with virtual generated columns is exploitable.
Users who are concerned about this can avoid selecting from views, but
telling them to avoid selecting from tables is less practical.
To address this, this changes it so that generation expressions for
virtual generated columns are restricted to using built-in functions
and types, and the columns are restricted to having a built-in type.
We assume that built-in functions and types cannot be exploited for
this purpose.
In the future, this could be expanded by some new mechanism to declare
other functions and types as safe or trusted for this purpose, but
that is to be designed.
(An alternative approach might have been to expand the
restrict_nonsystem_relation_kind GUC to handle this, like the fix for
CVE-2024-7348. But that is kind of an ugly approach. That fix had to
fit in the constraints of fixing an ancient vulnerability in all
branches. Since virtual generated columns are new, we're free from
the constraints of the past, and we can and should use cleaner
options.)
Reported-by: Feike Steenbergen <feikesteenbergen@gmail.com>
Reviewed-by: jian he <jian.universality@gmail.com>
Discussion: https://www.postgresql.org/message-id/flat/CAK_s-G2Q7de8Q0qOYUR%3D_CTB5FzzVBm5iZjOp%2BmeVWpMpmfO0w%4...
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/0cd69b3d7ef357f2b43258de5831c4de0bd51dec
Modified Files
--------------
doc/src/sgml/ddl.sgml | 10 +++
doc/src/sgml/ref/create_table.sgml | 9 +++
src/backend/catalog/heap.c | 93 +++++++++++++++++++++++++
src/include/catalog/catversion.h | 2 +-
src/test/regress/expected/generated_virtual.out | 43 ++++++------
src/test/regress/expected/publication.out | 12 +++-
src/test/regress/sql/generated_virtual.sql | 24 ++++---
src/test/regress/sql/publication.sql | 5 +-
8 files changed, 163 insertions(+), 35 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: peter@eisentraut.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Restrict virtual columns to use built-in functions and types
In-Reply-To: <E1uUL5G-003Fl7-1P@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox