From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robert Haas <robertmhaas@gmail.com>
cc: Joe Conway <mail@joeconway.com>, Andrew Dunstan <andrew@dunslane.net>,
        David Rowley <dgrowleyml@gmail.com>,
        PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: can we mark upper/lower/textlike functions leakproof?
In-reply-to: <CA+Tgmob78LN+Tkgms=dQyBsLyGWBuehv7_kEvBfjwmj6fDsr7g@mail.gmail.com>
References: <fa7903f6-b050-4c62-aa52-6f6d5d345770@dunslane.net> <CAApHDvr36T+9XZYTRkHkGm82Wo5YY6wXwkRDceu2-cyGEvHzjw@mail.gmail.com> <50d3a76e-afaa-44ed-aef5-6fb7f23cccab@dunslane.net> <5bef8bb0-7a50-4bcf-b052-2a12c3cda0f5@joeconway.com> <CA+Tgmob78LN+Tkgms=dQyBsLyGWBuehv7_kEvBfjwmj6fDsr7g@mail.gmail.com>
Comments: In-reply-to Robert Haas <robertmhaas@gmail.com>
	message dated "Wed, 31 Jul 2024 13:39:45 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3416372.1722449026.1@sss.pgh.pa.us>
Date: Wed, 31 Jul 2024 14:03:46 -0400
Message-ID: <3416373.1722449026@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/3416373.1722449026%40sss.pgh.pa.us>
Precedence: bulk

Robert Haas <robertmhaas@gmail.com> writes:
> If there are some inputs that cause upper() and lower() to fail and
> others that do not, the functions aren't leakproof, because an
> attacker can extract information about values that they can't see by
> feeding those values into these functions and seeing whether they get
> a failure or not.

> [ rather exhaustive analysis redacted ]

> So in summary, I think upper() is ... pretty close to leakproof. But
> if ICU sometimes fails on certain strings, then it isn't. And if the
> multi-byte libc path can be made to fail reliably either with really
> long strings or with certain choices of the LC_CTYPE locale, then it
> isn't.

The problem here is that marking these functions leakproof is a
promise about a *whole bunch* of code, much of it not under our
control; worse, there's no reason to think all that code is stable.
A large fraction of it didn't even exist a few versions ago.

Even if we could convince ourselves that the possible issues Robert
mentions aren't real at the moment, I think marking these leakproof
is mighty risky.  It's unlikely we'd remember to revisit the marking
the next time someone drops a bunch of new code in here.

			regards, tom lane