agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: Reject calls from SQL to functions that take or return type inte 6+ messages / 1 participants [nested] [flat]
* pgsql: Reject calls from SQL to functions that take or return type inte @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Reject calls from SQL to functions that take or return type internal. Allowing that is a security hole, since there are many different functions with different ideas of what their "internal" argument or result is. We already had a defense against the easy case of "'foo'::internal", but that turns out to be insufficient. Lock down both function and operator syntax. Also disallow attempts to cast to or from type internal; those would mostly fail anyway, but we have created some holes with features such as CoerceViaIO. Reported-by: Amy Burnett (OpenAI Codex Security) Author: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Backpatch-through: 14 Security: CVE-2026-14680 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/8f7e35b08ad5b5a400d0333188c17bb354174f60 Author: Tom Lane <tgl@sss.pgh.pa.us> Modified Files -------------- src/backend/parser/parse_coerce.c | 8 ++++++++ src/backend/parser/parse_func.c | 26 ++++++++++++++++++++++++++ src/backend/parser/parse_oper.c | 22 ++++++++++++++++++++++ src/pl/plpgsql/src/pl_exec.c | 12 ++++++++++-- 4 files changed, 66 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Reject calls from SQL to functions that take or return type inte @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Reject calls from SQL to functions that take or return type internal. Allowing that is a security hole, since there are many different functions with different ideas of what their "internal" argument or result is. We already had a defense against the easy case of "'foo'::internal", but that turns out to be insufficient. Lock down both function and operator syntax. Also disallow attempts to cast to or from type internal; those would mostly fail anyway, but we have created some holes with features such as CoerceViaIO. Reported-by: Amy Burnett (OpenAI Codex Security) Author: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Backpatch-through: 14 Security: CVE-2026-14680 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/21a00de43b3d887a72d79ac91407baa284070ed2 Author: Tom Lane <tgl@sss.pgh.pa.us> Modified Files -------------- src/backend/parser/parse_coerce.c | 8 ++++++++ src/backend/parser/parse_func.c | 26 ++++++++++++++++++++++++++ src/backend/parser/parse_oper.c | 22 ++++++++++++++++++++++ src/pl/plpgsql/src/pl_exec.c | 12 ++++++++++-- 4 files changed, 66 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Reject calls from SQL to functions that take or return type inte @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Reject calls from SQL to functions that take or return type internal. Allowing that is a security hole, since there are many different functions with different ideas of what their "internal" argument or result is. We already had a defense against the easy case of "'foo'::internal", but that turns out to be insufficient. Lock down both function and operator syntax. Also disallow attempts to cast to or from type internal; those would mostly fail anyway, but we have created some holes with features such as CoerceViaIO. Reported-by: Amy Burnett (OpenAI Codex Security) Author: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Backpatch-through: 14 Security: CVE-2026-14680 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/54649de65f0822ee0678cc2b2df6ad47de0a748e Author: Tom Lane <tgl@sss.pgh.pa.us> Modified Files -------------- src/backend/parser/parse_coerce.c | 8 ++++++++ src/backend/parser/parse_func.c | 26 ++++++++++++++++++++++++++ src/backend/parser/parse_oper.c | 22 ++++++++++++++++++++++ src/pl/plpgsql/src/pl_exec.c | 12 ++++++++++-- 4 files changed, 66 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Reject calls from SQL to functions that take or return type inte @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Reject calls from SQL to functions that take or return type internal. Allowing that is a security hole, since there are many different functions with different ideas of what their "internal" argument or result is. We already had a defense against the easy case of "'foo'::internal", but that turns out to be insufficient. Lock down both function and operator syntax. Also disallow attempts to cast to or from type internal; those would mostly fail anyway, but we have created some holes with features such as CoerceViaIO. Reported-by: Amy Burnett (OpenAI Codex Security) Author: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Backpatch-through: 14 Security: CVE-2026-14680 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/eb9e5529745c129c25deb04098612898998fb123 Author: Tom Lane <tgl@sss.pgh.pa.us> Modified Files -------------- src/backend/parser/parse_coerce.c | 8 ++++++++ src/backend/parser/parse_func.c | 26 ++++++++++++++++++++++++++ src/backend/parser/parse_oper.c | 22 ++++++++++++++++++++++ src/pl/plpgsql/src/pl_exec.c | 12 ++++++++++-- 4 files changed, 66 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Reject calls from SQL to functions that take or return type inte @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Reject calls from SQL to functions that take or return type internal. Allowing that is a security hole, since there are many different functions with different ideas of what their "internal" argument or result is. We already had a defense against the easy case of "'foo'::internal", but that turns out to be insufficient. Lock down both function and operator syntax. Also disallow attempts to cast to or from type internal; those would mostly fail anyway, but we have created some holes with features such as CoerceViaIO. Reported-by: Amy Burnett (OpenAI Codex Security) Author: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Backpatch-through: 14 Security: CVE-2026-14680 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/4c0c1b2cdf8d0702cca8de87e1ee87eb31aa1a4c Author: Tom Lane <tgl@sss.pgh.pa.us> Modified Files -------------- src/backend/parser/parse_coerce.c | 8 ++++++++ src/backend/parser/parse_func.c | 26 ++++++++++++++++++++++++++ src/backend/parser/parse_oper.c | 22 ++++++++++++++++++++++ src/pl/plpgsql/src/pl_exec.c | 12 ++++++++++-- 4 files changed, 66 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Reject calls from SQL to functions that take or return type inte @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Reject calls from SQL to functions that take or return type internal. Allowing that is a security hole, since there are many different functions with different ideas of what their "internal" argument or result is. We already had a defense against the easy case of "'foo'::internal", but that turns out to be insufficient. Lock down both function and operator syntax. Also disallow attempts to cast to or from type internal; those would mostly fail anyway, but we have created some holes with features such as CoerceViaIO. Reported-by: Amy Burnett (OpenAI Codex Security) Author: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Backpatch-through: 14 Security: CVE-2026-14680 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/e926a9aacbd7a3b20d1e806b0e8445a62d9f8168 Author: Tom Lane <tgl@sss.pgh.pa.us> Modified Files -------------- src/backend/parser/parse_coerce.c | 8 ++++++++ src/backend/parser/parse_func.c | 26 ++++++++++++++++++++++++++ src/backend/parser/parse_oper.c | 22 ++++++++++++++++++++++ src/pl/plpgsql/src/pl_exec.c | 12 ++++++++++-- 4 files changed, 66 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2026-08-10 13:41 UTC | newest] Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-08-10 13:41 pgsql: Reject calls from SQL to functions that take or return type inte Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Reject calls from SQL to functions that take or return type inte Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Reject calls from SQL to functions that take or return type inte Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Reject calls from SQL to functions that take or return type inte Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Reject calls from SQL to functions that take or return type inte Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Reject calls from SQL to functions that take or return type inte Noah Misch <noah@leadboat.com>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox