pg.ddx.io pgsql-committers@postgresql.org mailing list archive
help / color / mirror / Atom feedpgsql: Fix inconsistent quoting of role names in ACLs.
7+ messages / 1 participants
[nested] [flat]
* pgsql: Fix inconsistent quoting of role names in ACLs.
@ 2025-07-11 22:50 Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 7+ messages in thread
From: Tom Lane @ 2025-07-11 22:50 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix inconsistent quoting of role names in ACLs.
getid() and putid(), which parse and deparse role names within ACL
input/output, applied isalnum() to see if a character within a role
name requires quoting. They did this even for non-ASCII characters,
which is problematic because the results would depend on encoding,
locale, and perhaps even platform. So it's possible that putid()
could elect not to quote some string that, later in some other
environment, getid() will decide is not a valid identifier, causing
dump/reload or similar failures.
To fix this in a way that won't risk interoperability problems
with unpatched versions, make getid() treat any non-ASCII as a
legitimate identifier character (hence not requiring quotes),
while making putid() treat any non-ASCII as requiring quoting.
We could remove the resulting excess quoting once we feel that
no unpatched servers remain in the wild, but that'll be years.
A lesser problem is that getid() did the wrong thing with an input
consisting of just two double quotes (""). That has to represent an
empty string, but getid() read it as a single double quote instead.
The case cannot arise in the normal course of events, since we don't
allow empty-string role names. But let's fix it while we're here.
Although we've not heard field reports of problems with non-ASCII
role names, there's clearly a hazard there, so back-patch to all
supported versions.
Reported-by: Peter Eisentraut <peter@eisentraut.org>
Author: Tom Lane <tgl@sss.pgh.pa.us>
Discussion: https://postgr.es/m/3792884.1751492172@sss.pgh.pa.us
Backpatch-through: 13
Branch
------
REL_15_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/de73cb3ed6cc9d51350ac54528c5ffc688aab6ce
Modified Files
--------------
src/backend/utils/adt/acl.c | 33 ++++++++++++++++++++++++--------
src/test/regress/expected/privileges.out | 20 +++++++++++++++++++
src/test/regress/sql/privileges.sql | 8 ++++++++
3 files changed, 53 insertions(+), 8 deletions(-)
^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Fix inconsistent quoting of role names in ACLs.
@ 2025-07-11 22:50 Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 7+ messages in thread
From: Tom Lane @ 2025-07-11 22:50 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix inconsistent quoting of role names in ACLs.
getid() and putid(), which parse and deparse role names within ACL
input/output, applied isalnum() to see if a character within a role
name requires quoting. They did this even for non-ASCII characters,
which is problematic because the results would depend on encoding,
locale, and perhaps even platform. So it's possible that putid()
could elect not to quote some string that, later in some other
environment, getid() will decide is not a valid identifier, causing
dump/reload or similar failures.
To fix this in a way that won't risk interoperability problems
with unpatched versions, make getid() treat any non-ASCII as a
legitimate identifier character (hence not requiring quotes),
while making putid() treat any non-ASCII as requiring quoting.
We could remove the resulting excess quoting once we feel that
no unpatched servers remain in the wild, but that'll be years.
A lesser problem is that getid() did the wrong thing with an input
consisting of just two double quotes (""). That has to represent an
empty string, but getid() read it as a single double quote instead.
The case cannot arise in the normal course of events, since we don't
allow empty-string role names. But let's fix it while we're here.
Although we've not heard field reports of problems with non-ASCII
role names, there's clearly a hazard there, so back-patch to all
supported versions.
Reported-by: Peter Eisentraut <peter@eisentraut.org>
Author: Tom Lane <tgl@sss.pgh.pa.us>
Discussion: https://postgr.es/m/3792884.1751492172@sss.pgh.pa.us
Backpatch-through: 13
Branch
------
REL_13_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/093d3d74576e1e60212622dbaeeb3eb2b184fbf3
Modified Files
--------------
src/backend/utils/adt/acl.c | 33 ++++++++++++++++++++++++--------
src/test/regress/expected/privileges.out | 20 +++++++++++++++++++
src/test/regress/sql/privileges.sql | 8 ++++++++
3 files changed, 53 insertions(+), 8 deletions(-)
^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Fix inconsistent quoting of role names in ACLs.
@ 2025-07-11 22:50 Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 7+ messages in thread
From: Tom Lane @ 2025-07-11 22:50 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix inconsistent quoting of role names in ACLs.
getid() and putid(), which parse and deparse role names within ACL
input/output, applied isalnum() to see if a character within a role
name requires quoting. They did this even for non-ASCII characters,
which is problematic because the results would depend on encoding,
locale, and perhaps even platform. So it's possible that putid()
could elect not to quote some string that, later in some other
environment, getid() will decide is not a valid identifier, causing
dump/reload or similar failures.
To fix this in a way that won't risk interoperability problems
with unpatched versions, make getid() treat any non-ASCII as a
legitimate identifier character (hence not requiring quotes),
while making putid() treat any non-ASCII as requiring quoting.
We could remove the resulting excess quoting once we feel that
no unpatched servers remain in the wild, but that'll be years.
A lesser problem is that getid() did the wrong thing with an input
consisting of just two double quotes (""). That has to represent an
empty string, but getid() read it as a single double quote instead.
The case cannot arise in the normal course of events, since we don't
allow empty-string role names. But let's fix it while we're here.
Although we've not heard field reports of problems with non-ASCII
role names, there's clearly a hazard there, so back-patch to all
supported versions.
Reported-by: Peter Eisentraut <peter@eisentraut.org>
Author: Tom Lane <tgl@sss.pgh.pa.us>
Discussion: https://postgr.es/m/3792884.1751492172@sss.pgh.pa.us
Backpatch-through: 13
Branch
------
REL_14_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/ac8cdb2495d580d6ff08aa624e7851453d3cc2da
Modified Files
--------------
src/backend/utils/adt/acl.c | 33 ++++++++++++++++++++++++--------
src/test/regress/expected/privileges.out | 20 +++++++++++++++++++
src/test/regress/sql/privileges.sql | 8 ++++++++
3 files changed, 53 insertions(+), 8 deletions(-)
^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Fix inconsistent quoting of role names in ACLs.
@ 2025-07-11 22:50 Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 7+ messages in thread
From: Tom Lane @ 2025-07-11 22:50 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix inconsistent quoting of role names in ACLs.
getid() and putid(), which parse and deparse role names within ACL
input/output, applied isalnum() to see if a character within a role
name requires quoting. They did this even for non-ASCII characters,
which is problematic because the results would depend on encoding,
locale, and perhaps even platform. So it's possible that putid()
could elect not to quote some string that, later in some other
environment, getid() will decide is not a valid identifier, causing
dump/reload or similar failures.
To fix this in a way that won't risk interoperability problems
with unpatched versions, make getid() treat any non-ASCII as a
legitimate identifier character (hence not requiring quotes),
while making putid() treat any non-ASCII as requiring quoting.
We could remove the resulting excess quoting once we feel that
no unpatched servers remain in the wild, but that'll be years.
A lesser problem is that getid() did the wrong thing with an input
consisting of just two double quotes (""). That has to represent an
empty string, but getid() read it as a single double quote instead.
The case cannot arise in the normal course of events, since we don't
allow empty-string role names. But let's fix it while we're here.
Although we've not heard field reports of problems with non-ASCII
role names, there's clearly a hazard there, so back-patch to all
supported versions.
Reported-by: Peter Eisentraut <peter@eisentraut.org>
Author: Tom Lane <tgl@sss.pgh.pa.us>
Discussion: https://postgr.es/m/3792884.1751492172@sss.pgh.pa.us
Backpatch-through: 13
Branch
------
REL_17_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/50959f96e7b17c3f225919edbec4072c033aef60
Modified Files
--------------
src/backend/utils/adt/acl.c | 33 ++++++++++++++++++++++++--------
src/test/regress/expected/privileges.out | 20 +++++++++++++++++++
src/test/regress/sql/privileges.sql | 8 ++++++++
3 files changed, 53 insertions(+), 8 deletions(-)
^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Fix inconsistent quoting of role names in ACLs.
@ 2025-07-11 22:50 Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 7+ messages in thread
From: Tom Lane @ 2025-07-11 22:50 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix inconsistent quoting of role names in ACLs.
getid() and putid(), which parse and deparse role names within ACL
input/output, applied isalnum() to see if a character within a role
name requires quoting. They did this even for non-ASCII characters,
which is problematic because the results would depend on encoding,
locale, and perhaps even platform. So it's possible that putid()
could elect not to quote some string that, later in some other
environment, getid() will decide is not a valid identifier, causing
dump/reload or similar failures.
To fix this in a way that won't risk interoperability problems
with unpatched versions, make getid() treat any non-ASCII as a
legitimate identifier character (hence not requiring quotes),
while making putid() treat any non-ASCII as requiring quoting.
We could remove the resulting excess quoting once we feel that
no unpatched servers remain in the wild, but that'll be years.
A lesser problem is that getid() did the wrong thing with an input
consisting of just two double quotes (""). That has to represent an
empty string, but getid() read it as a single double quote instead.
The case cannot arise in the normal course of events, since we don't
allow empty-string role names. But let's fix it while we're here.
Although we've not heard field reports of problems with non-ASCII
role names, there's clearly a hazard there, so back-patch to all
supported versions.
Reported-by: Peter Eisentraut <peter@eisentraut.org>
Author: Tom Lane <tgl@sss.pgh.pa.us>
Discussion: https://postgr.es/m/3792884.1751492172@sss.pgh.pa.us
Backpatch-through: 13
Branch
------
REL_16_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/53a936b61f12cd9220340abc1a7843eb003d1abf
Modified Files
--------------
src/backend/utils/adt/acl.c | 33 ++++++++++++++++++++++++--------
src/test/regress/expected/privileges.out | 20 +++++++++++++++++++
src/test/regress/sql/privileges.sql | 8 ++++++++
3 files changed, 53 insertions(+), 8 deletions(-)
^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Fix inconsistent quoting of role names in ACLs.
@ 2025-07-11 22:50 Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 7+ messages in thread
From: Tom Lane @ 2025-07-11 22:50 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix inconsistent quoting of role names in ACLs.
getid() and putid(), which parse and deparse role names within ACL
input/output, applied isalnum() to see if a character within a role
name requires quoting. They did this even for non-ASCII characters,
which is problematic because the results would depend on encoding,
locale, and perhaps even platform. So it's possible that putid()
could elect not to quote some string that, later in some other
environment, getid() will decide is not a valid identifier, causing
dump/reload or similar failures.
To fix this in a way that won't risk interoperability problems
with unpatched versions, make getid() treat any non-ASCII as a
legitimate identifier character (hence not requiring quotes),
while making putid() treat any non-ASCII as requiring quoting.
We could remove the resulting excess quoting once we feel that
no unpatched servers remain in the wild, but that'll be years.
A lesser problem is that getid() did the wrong thing with an input
consisting of just two double quotes (""). That has to represent an
empty string, but getid() read it as a single double quote instead.
The case cannot arise in the normal course of events, since we don't
allow empty-string role names. But let's fix it while we're here.
Although we've not heard field reports of problems with non-ASCII
role names, there's clearly a hazard there, so back-patch to all
supported versions.
Reported-by: Peter Eisentraut <peter@eisentraut.org>
Author: Tom Lane <tgl@sss.pgh.pa.us>
Discussion: https://postgr.es/m/3792884.1751492172@sss.pgh.pa.us
Backpatch-through: 13
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/64840e46243a5f672b9e2fcb8d93c63daec4bc9a
Modified Files
--------------
src/backend/utils/adt/acl.c | 33 ++++++++++++++++++++++++--------
src/test/regress/expected/privileges.out | 20 +++++++++++++++++++
src/test/regress/sql/privileges.sql | 8 ++++++++
3 files changed, 53 insertions(+), 8 deletions(-)
^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Fix inconsistent quoting of role names in ACLs.
@ 2025-07-11 22:50 Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 7+ messages in thread
From: Tom Lane @ 2025-07-11 22:50 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix inconsistent quoting of role names in ACLs.
getid() and putid(), which parse and deparse role names within ACL
input/output, applied isalnum() to see if a character within a role
name requires quoting. They did this even for non-ASCII characters,
which is problematic because the results would depend on encoding,
locale, and perhaps even platform. So it's possible that putid()
could elect not to quote some string that, later in some other
environment, getid() will decide is not a valid identifier, causing
dump/reload or similar failures.
To fix this in a way that won't risk interoperability problems
with unpatched versions, make getid() treat any non-ASCII as a
legitimate identifier character (hence not requiring quotes),
while making putid() treat any non-ASCII as requiring quoting.
We could remove the resulting excess quoting once we feel that
no unpatched servers remain in the wild, but that'll be years.
A lesser problem is that getid() did the wrong thing with an input
consisting of just two double quotes (""). That has to represent an
empty string, but getid() read it as a single double quote instead.
The case cannot arise in the normal course of events, since we don't
allow empty-string role names. But let's fix it while we're here.
Although we've not heard field reports of problems with non-ASCII
role names, there's clearly a hazard there, so back-patch to all
supported versions.
Reported-by: Peter Eisentraut <peter@eisentraut.org>
Author: Tom Lane <tgl@sss.pgh.pa.us>
Discussion: https://postgr.es/m/3792884.1751492172@sss.pgh.pa.us
Backpatch-through: 13
Branch
------
REL_18_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/ccacaf4fae242cf71ed5d4f7c39ca0645ca4ca9c
Modified Files
--------------
src/backend/utils/adt/acl.c | 33 ++++++++++++++++++++++++--------
src/test/regress/expected/privileges.out | 20 +++++++++++++++++++
src/test/regress/sql/privileges.sql | 8 ++++++++
3 files changed, 53 insertions(+), 8 deletions(-)
^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2025-07-11 22:50 UTC | newest]
Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2025-07-11 22:50 pgsql: Fix inconsistent quoting of role names in ACLs. Tom Lane <tgl@sss.pgh.pa.us>
2025-07-11 22:50 pgsql: Fix inconsistent quoting of role names in ACLs. Tom Lane <tgl@sss.pgh.pa.us>
2025-07-11 22:50 pgsql: Fix inconsistent quoting of role names in ACLs. Tom Lane <tgl@sss.pgh.pa.us>
2025-07-11 22:50 pgsql: Fix inconsistent quoting of role names in ACLs. Tom Lane <tgl@sss.pgh.pa.us>
2025-07-11 22:50 pgsql: Fix inconsistent quoting of role names in ACLs. Tom Lane <tgl@sss.pgh.pa.us>
2025-07-11 22:50 pgsql: Fix inconsistent quoting of role names in ACLs. Tom Lane <tgl@sss.pgh.pa.us>
2025-07-11 22:50 pgsql: Fix inconsistent quoting of role names in ACLs. Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox