From: Nathan Bossart <nathan@postgresql.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Restrict psql meta-commands in plain-text dumps.
Date: Mon, 11 Aug 2025 14:00:49 +0000
Message-ID: <E1ulT4z-0002QE-0t@gemulon.postgresql.org> (raw)
Restrict psql meta-commands in plain-text dumps.
A malicious server could inject psql meta-commands into plain-text
dump output (i.e., scripts created with pg_dump --format=plain,
pg_dumpall, or pg_restore --file) that are run at restore time on
the machine running psql. To fix, introduce a new "restricted"
mode in psql that blocks all meta-commands (except for \unrestrict
to exit the mode), and teach pg_dump, pg_dumpall, and pg_restore to
use this mode in plain-text dumps.
While at it, encourage users to only restore dumps generated from
trusted servers or to inspect it beforehand, since restoring causes
the destination to execute arbitrary code of the source superusers'
choice. However, the client running the dump and restore needn't
trust the source or destination superusers.
Reported-by: Martin Rakhmanov
Reported-by: Matthieu Denais <litezeraw@gmail.com>
Reported-by: RyotaK <ryotak.mail@gmail.com>
Suggested-by: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Noah Misch <noah@leadboat.com>
Reviewed-by: Michael Paquier <michael@paquier.xyz>
Reviewed-by: Peter Eisentraut <peter@eisentraut.org>
Security: CVE-2025-8714
Backpatch-through: 13
Branch
------
REL_18_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/67a2fbb8f9e9f75df08208e75da412c43a814688
Modified Files
--------------
doc/src/sgml/ref/pg_dump.sgml | 35 +++++++++
doc/src/sgml/ref/pg_dumpall.sgml | 30 ++++++++
doc/src/sgml/ref/pg_restore.sgml | 34 ++++++++
doc/src/sgml/ref/pgupgrade.sgml | 8 ++
doc/src/sgml/ref/psql-ref.sgml | 36 +++++++++
src/bin/pg_combinebackup/t/002_compare_backups.pl | 2 +
src/bin/pg_dump/dumputils.c | 38 +++++++++
src/bin/pg_dump/dumputils.h | 3 +
src/bin/pg_dump/pg_backup.h | 4 +
src/bin/pg_dump/pg_backup_archiver.c | 32 +++++++-
src/bin/pg_dump/pg_dump.c | 21 +++++
src/bin/pg_dump/pg_dumpall.c | 36 +++++++++
src/bin/pg_dump/pg_restore.c | 23 ++++++
src/bin/pg_dump/t/002_pg_dump.pl | 26 +++++--
src/bin/pg_upgrade/t/002_pg_upgrade.pl | 3 +
src/bin/psql/command.c | 94 ++++++++++++++++++++++-
src/bin/psql/help.c | 4 +
src/bin/psql/t/001_basic.pl | 7 ++
src/bin/psql/tab-complete.in.c | 4 +-
src/test/recovery/t/027_stream_regress.pl | 4 +
src/test/regress/expected/psql.out | 2 +
src/test/regress/sql/psql.sql | 2 +
22 files changed, 435 insertions(+), 13 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: nathan@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Restrict psql meta-commands in plain-text dumps.
In-Reply-To: <E1ulT4z-0002QE-0t@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox