agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: Obstruct EXTRACT() field name deparse injection. 6+ messages / 1 participants [nested] [flat]
* pgsql: Obstruct EXTRACT() field name deparse injection. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Obstruct EXTRACT() field name deparse injection. The parser accepts any string as an EXTRACT() field name, but deparsing does not quote and escape it accordingly. To fix, quote and escape the field name during deparsing as needed. It might be a good idea to validate the field name during parsing and deparsing, too, but that is left as a future exercise. Reported-by: Ben Morris in collaboration with Claude and Anthropic Research Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Etsuro Fujita <etsuro.fujita@gmail.com> Security: CVE-2026-15741 Backpatch-through: 14 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/f9729b5078dca08f5c873ca063f0449e8bb3f256 Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- src/backend/utils/adt/ruleutils.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Obstruct EXTRACT() field name deparse injection. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Obstruct EXTRACT() field name deparse injection. The parser accepts any string as an EXTRACT() field name, but deparsing does not quote and escape it accordingly. To fix, quote and escape the field name during deparsing as needed. It might be a good idea to validate the field name during parsing and deparsing, too, but that is left as a future exercise. Reported-by: Ben Morris in collaboration with Claude and Anthropic Research Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Etsuro Fujita <etsuro.fujita@gmail.com> Security: CVE-2026-15741 Backpatch-through: 14 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/a3832a7571013469dc81e35d0fe1c0066e86d893 Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- src/backend/utils/adt/ruleutils.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Obstruct EXTRACT() field name deparse injection. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Obstruct EXTRACT() field name deparse injection. The parser accepts any string as an EXTRACT() field name, but deparsing does not quote and escape it accordingly. To fix, quote and escape the field name during deparsing as needed. It might be a good idea to validate the field name during parsing and deparsing, too, but that is left as a future exercise. Reported-by: Ben Morris in collaboration with Claude and Anthropic Research Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Etsuro Fujita <etsuro.fujita@gmail.com> Security: CVE-2026-15741 Backpatch-through: 14 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/0ddd9098a310ed711c6cba758c06dfe38f9654ff Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- src/backend/utils/adt/ruleutils.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Obstruct EXTRACT() field name deparse injection. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Obstruct EXTRACT() field name deparse injection. The parser accepts any string as an EXTRACT() field name, but deparsing does not quote and escape it accordingly. To fix, quote and escape the field name during deparsing as needed. It might be a good idea to validate the field name during parsing and deparsing, too, but that is left as a future exercise. Reported-by: Ben Morris in collaboration with Claude and Anthropic Research Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Etsuro Fujita <etsuro.fujita@gmail.com> Security: CVE-2026-15741 Backpatch-through: 14 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/5981fe370a0d433429977ff6fc420064cf2fa09a Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- src/backend/utils/adt/ruleutils.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Obstruct EXTRACT() field name deparse injection. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Obstruct EXTRACT() field name deparse injection. The parser accepts any string as an EXTRACT() field name, but deparsing does not quote and escape it accordingly. To fix, quote and escape the field name during deparsing as needed. It might be a good idea to validate the field name during parsing and deparsing, too, but that is left as a future exercise. Reported-by: Ben Morris in collaboration with Claude and Anthropic Research Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Etsuro Fujita <etsuro.fujita@gmail.com> Security: CVE-2026-15741 Backpatch-through: 14 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/5e5ea74e389b0736adfc5aea3dd2ca102a997d65 Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- src/backend/utils/adt/ruleutils.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Obstruct EXTRACT() field name deparse injection. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Obstruct EXTRACT() field name deparse injection. The parser accepts any string as an EXTRACT() field name, but deparsing does not quote and escape it accordingly. To fix, quote and escape the field name during deparsing as needed. It might be a good idea to validate the field name during parsing and deparsing, too, but that is left as a future exercise. Reported-by: Ben Morris in collaboration with Claude and Anthropic Research Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Etsuro Fujita <etsuro.fujita@gmail.com> Security: CVE-2026-15741 Backpatch-through: 14 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/44ea6764be76ebb3d8dd01d60b5751acbe7b87d3 Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- src/backend/utils/adt/ruleutils.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2026-08-10 13:41 UTC | newest] Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-08-10 13:41 pgsql: Obstruct EXTRACT() field name deparse injection. Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Obstruct EXTRACT() field name deparse injection. Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Obstruct EXTRACT() field name deparse injection. Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Obstruct EXTRACT() field name deparse injection. Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Obstruct EXTRACT() field name deparse injection. Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Obstruct EXTRACT() field name deparse injection. Noah Misch <noah@leadboat.com>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox