agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: Check EXECUTE privilege on functions invoked by the RI fast path 2+ messages / 1 participants [nested] [flat]
* pgsql: Check EXECUTE privilege on functions invoked by the RI fast path @ 2026-09-26 02:14 Amit Langote <amitlan@postgresql.org> 0 siblings, 0 replies; 2+ messages in thread From: Amit Langote @ 2026-09-26 02:14 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Check EXECUTE privilege on functions invoked by the RI fast path ri_FastPathCheck() invokes two functions on the FK values: the equality operator's function, via the ScanKey the index AM evaluates, and, when the FK column's type differs from the PK column's, the implicit cast function. The SPI path gets EXECUTE on both checked by ExecInitFunc() when it initializes the generated query, as the referenced table's owner, but the fast path performed neither check. Add ri_CheckFunctionPermissions() and call it once the fast-path metadata is populated, under the switch to the referenced table's owner, so the checks happen at the same point as the existing relation permission check. Add a regression test for each function, reaching the fast path through per-row validation of a new constraint, and repeat each against a partitioned referenced table, which takes the SPI path, to show that the two behave identically. Reported-by: Nikolay Samokhvalov <nik@postgres.ai> (offlist) Reviewed-by: Matheus Alcantara <matheusssilv97@gmail.com> Discussion: https://postgr.es/m/CA+HiwqGH+b7sXmsH8sT18diujbheSObWs0gWXqLZqRccMKvZAA@mail.gmail.com Backpatch-through: 19 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/f8eb70f05062d5765fe7a7685b112f51bcca2d3e Modified Files -------------- src/backend/utils/adt/ri_triggers.c | 40 +++++++++++++++ src/test/regress/expected/foreign_key.out | 81 +++++++++++++++++++++++++++++++ src/test/regress/sql/foreign_key.sql | 81 +++++++++++++++++++++++++++++++ 3 files changed, 202 insertions(+) ^ permalink raw reply [nested|flat] 2+ messages in thread
* pgsql: Check EXECUTE privilege on functions invoked by the RI fast path @ 2026-09-26 02:14 Amit Langote <amitlan@postgresql.org> 0 siblings, 0 replies; 2+ messages in thread From: Amit Langote @ 2026-09-26 02:14 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Check EXECUTE privilege on functions invoked by the RI fast path ri_FastPathCheck() invokes two functions on the FK values: the equality operator's function, via the ScanKey the index AM evaluates, and, when the FK column's type differs from the PK column's, the implicit cast function. The SPI path gets EXECUTE on both checked by ExecInitFunc() when it initializes the generated query, as the referenced table's owner, but the fast path performed neither check. Add ri_CheckFunctionPermissions() and call it once the fast-path metadata is populated, under the switch to the referenced table's owner, so the checks happen at the same point as the existing relation permission check. Add a regression test for each function, reaching the fast path through per-row validation of a new constraint, and repeat each against a partitioned referenced table, which takes the SPI path, to show that the two behave identically. Reported-by: Nikolay Samokhvalov <nik@postgres.ai> (offlist) Reviewed-by: Matheus Alcantara <matheusssilv97@gmail.com> Discussion: https://postgr.es/m/CA+HiwqGH+b7sXmsH8sT18diujbheSObWs0gWXqLZqRccMKvZAA@mail.gmail.com Backpatch-through: 19 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/1a846a555afb0e5f2008f3aefe8f77acbe6ffba6 Modified Files -------------- src/backend/utils/adt/ri_triggers.c | 40 +++++++++++++++ src/test/regress/expected/foreign_key.out | 81 +++++++++++++++++++++++++++++++ src/test/regress/sql/foreign_key.sql | 81 +++++++++++++++++++++++++++++++ 3 files changed, 202 insertions(+) ^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2026-09-26 02:14 UTC | newest] Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-09-26 02:14 pgsql: Check EXECUTE privilege on functions invoked by the RI fast path Amit Langote <amitlan@postgresql.org> 2026-09-26 02:14 pgsql: Check EXECUTE privilege on functions invoked by the RI fast path Amit Langote <amitlan@postgresql.org>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox