pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Dean Rasheed <dean.a.rasheed@gmail.com>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: Tomas Vondra <tomas.vondra@2ndquadrant.com>
Cc: Andres Freund <andres@anarazel.de>
Cc: PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: Multivariate MCV stats can leak data to unprivileged users
Date: Sun, 19 May 2019 10:28:43 -0400
Message-ID: <23772.1558276123@sss.pgh.pa.us> (raw)
In-Reply-To: <23229.1558275148@sss.pgh.pa.us>
References: <20190517202938.lkx6q2u6woiptrsa@alap3.anarazel.de>
	<CAEZATCX9yU2eKL7-dCWTv1pMMi1hb+PsZyM6gjBxupDnMuEzRw@mail.gmail.com>
	<CAEZATCV5fo2E6K5EVN2uytGjMvhTKTizP_rOW67nPqNK8jHAAg@mail.gmail.com>
	<21269.1558192388@sss.pgh.pa.us>
	<CAEZATCW3iAJnU8opUCXb2i_-8syU7on4cdXLWHBeWr04v67HoQ@mail.gmail.com>
	<4E0E0C14-C476-446A-835F-CC3558709DA9@anarazel.de>
	<20190518190042.2y33h4toxk4fxv5t@development>
	<568.1558208711@sss.pgh.pa.us>
	<20190518232812.qpnjmydlx3uzzsj7@development>
	<20866.1558223060@sss.pgh.pa.us>
	<20190518234841.GE6197@tamriel.snowman.net>
	<CAEZATCUcoAKrn-1NFkDN7md-wt6CQev0JXa+Tv31T9Jjkxgx5Q@mail.gmail.com>
	<23229.1558275148@sss.pgh.pa.us>

I wrote:
> I wonder ... another way we could potentially do this is

> create table pg_statistic_ext_data(
>     stxoid oid,  -- OID of owning pg_statistic_ext entry
>     stxkind char, -- what kind of data
>     stxdata bytea -- the data, in some format or other
> );

> The advantage of this way is that we'd not have to rejigger the
> catalog's rowtype every time we think of a new kind of extended
> stats.  The disadvantage is that manual inspection of the contents
> of an entry would become much harder, for lack of any convenient
> output function.

No, wait, scratch that.  We could fold the three existing types
pg_ndistinct, pg_dependencies, pg_mcv_list into one new type, say
"pg_stats_ext_data", where the actual storage would need to have an
ID field (so we'd waste a byte or two duplicating the externally
visible stxkind field inside stxdata).  The output function for this
type is just a switch over the existing code.  The big advantage of
this way compared to the current approach is that adding a new
ext-stats type requires *zero* work with adding new catalog entries.
Just add another switch case in pg_stats_ext_data_out() and you're
done.

			regards, tom lane





view thread (34+ messages)  latest in thread

Message-ID: <23772.1558276123@sss.pgh.pa.us>
Permalink:  ../23772.1558276123@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/23772.1558276123@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: tgl@sss.pgh.pa.us, dean.a.rasheed@gmail.com, sfrost@snowman.net, tomas.vondra@2ndquadrant.com, andres@anarazel.de
  Subject: Re: Multivariate MCV stats can leak data to unprivileged users
  In-Reply-To: <23772.1558276123@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox