agora inbox for pgsql-committers@postgresql.org
help / color / mirror / Atom feedFrom: Amit Langote <amitlan@postgresql.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Check EXECUTE privilege on functions invoked by the RI fast path
Date: Sat, 26 Sep 2026 02:14:28 +0000
Message-ID: <E1xAHvo-00000001I1n-2vfQ@gemulon.postgresql.org> (raw)
Check EXECUTE privilege on functions invoked by the RI fast path
ri_FastPathCheck() invokes two functions on the FK values: the
equality operator's function, via the ScanKey the index AM evaluates,
and, when the FK column's type differs from the PK column's, the
implicit cast function. The SPI path gets EXECUTE on both checked by
ExecInitFunc() when it initializes the generated query, as the
referenced table's owner, but the fast path performed neither check.
Add ri_CheckFunctionPermissions() and call it once the fast-path
metadata is populated, under the switch to the referenced table's
owner, so the checks happen at the same point as the existing relation
permission check. Add a regression test for each function, reaching
the fast path through per-row validation of a new constraint, and
repeat each against a partitioned referenced table, which takes the
SPI path, to show that the two behave identically.
Reported-by: Nikolay Samokhvalov <nik@postgres.ai> (offlist)
Reviewed-by: Matheus Alcantara <matheusssilv97@gmail.com>
Discussion: https://postgr.es/m/CA+HiwqGH+b7sXmsH8sT18diujbheSObWs0gWXqLZqRccMKvZAA@mail.gmail.com
Backpatch-through: 19
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/1a846a555afb0e5f2008f3aefe8f77acbe6ffba6
Modified Files
--------------
src/backend/utils/adt/ri_triggers.c | 40 +++++++++++++++
src/test/regress/expected/foreign_key.out | 81 +++++++++++++++++++++++++++++++
src/test/regress/sql/foreign_key.sql | 81 +++++++++++++++++++++++++++++++
3 files changed, 202 insertions(+)
view thread (2+ messages)
Message-ID: <E1xAHvo-00000001I1n-2vfQ@gemulon.postgresql.org>
Permalink: ../E1xAHvo-00000001I1n-2vfQ@gemulon.postgresql.org/
Also on: postgresql.org/message-id/E1xAHvo-00000001I1n-2vfQ@gemulon.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: amitlan@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Check EXECUTE privilege on functions invoked by the RI fast path
In-Reply-To: <E1xAHvo-00000001I1n-2vfQ@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox