Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1vbjYl-00BsJd-0M for pgsql-hackers@arkaria.postgresql.org; Fri, 02 Jan 2026 18:07:36 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1vbjYj-00AZ7H-0x for pgsql-hackers@arkaria.postgresql.org; Fri, 02 Jan 2026 18:07:34 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1vbjYi-00AZ79-37 for pgsql-hackers@lists.postgresql.org; Fri, 02 Jan 2026 18:07:33 +0000 Received: from mail-pg1-x544.google.com ([2607:f8b0:4864:20::544]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.96) (envelope-from ) id 1vbjYh-0047PA-0J for pgsql-hackers@lists.postgresql.org; Fri, 02 Jan 2026 18:07:33 +0000 Received: by mail-pg1-x544.google.com with SMTP id 41be03b00d2f7-bc274b8b15bso13243680a12.1 for ; Fri, 02 Jan 2026 10:07:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1767377249; x=1767982049; darn=lists.postgresql.org; h=references:to:cc:in-reply-to:date:subject:mime-version:message-id :from:from:to:cc:subject:date:message-id:reply-to; bh=Ix/REEjfn8FRpkIZ3LYkT++EuiQHNL14Hmv6o3RZt3E=; b=kcFfDVsOwMJKj4zO5WTa34epb4cLaSaP0qHf/WcJRcpuxAGxNh7R7rol6mCP3Ra/Nl sbTkZMNrbq1HXM3zLy73dUIAtbwBW1ZsDktAE2SNJUryqn921ZpHbT05IUNvFpOdARKY oVfCsu+Tk4WS7feyD7Ml26zY+RJNJat2xc8r+UpyA39fomXn3rNpeYRG9vy5gWXhFTWA hODS6MpSdGY9EYFTi+eR2Oo765AZgv47iuVDrjr6vFUGD2QltUr0yYVRmYbbC9KHxWVE h6/97KGJ2UsGTzppVGMXqSsrVRsV520gnSgcGR9+SJ1+9lIS5rau1N0ODt3oE6tlu67H doIw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767377249; x=1767982049; h=references:to:cc:in-reply-to:date:subject:mime-version:message-id :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Ix/REEjfn8FRpkIZ3LYkT++EuiQHNL14Hmv6o3RZt3E=; b=HEAToygcFNG+rCF8DEb2y9nK/4fa2eWuASp2PSAGC8g5M86hgLAX8JCPz3hrMmfo6k MZSH1ZVPlvIIpqZ0TZ/+3yjVHd/sQOOzwsVYkVfxjv18g/yWXmtpsEbw88f7UBw4LpEU k8DXCA+zTDEuMB9ZYEtTUkSQLrZ7CAcA5a9dMebRIxXt6uzl1+7qTL7BVLcJH/fTPYVp u3wbO+7+A930I08SDPIwnMou+Ede0yCy1Ig2cULXVI3suHpGLrYp/v/sNs4G4xF/IhYG SPAsZGRlyJ0weGgYWYCr9AfJwspx86DCFSAyN09QaEVVWjOwMQXGrNtdR/SOfNo4LVDh +egA== X-Gm-Message-State: AOJu0Yz692xfCxObvnVIq3+LocjgqcuAYZJnsc4pNPf7kPSQmUU8C/1E XOuIXKgsyDNWyO9Gsdiw4QIBaSNEUmvdI7M9URp1y1nTtE8Uj6BEJxfq X-Gm-Gg: AY/fxX6HLzKA66SfEpTiR+6ovZL6m5qVsfN0K9YBdyXJ56gFhn912GFTQAlvkFqeHl4 qQCHPii3E0o5z2JNu8TrBHHgrs8wPWzoGdBeK0LmV67WETw2ai4vcA5MOcoGv/e/qKwyEvt5qH6 WTHAhKlY2c2dcX2lt6Ir1tqGlU3k/Jg6CblmkJz8q5LpLpVL8Kcg71WW42Vpo9gACmcDF2+57Tw d1bNWY0/UIqXN60agicmnaIZ0OGhGujrb1gVWUZJyt/faPGkqfgb81mWB5PUirkSF3b5WBHDlMK DCSrbxHiAnNdidHkafTk9hSu8x7da6jsNXMmEXcNtwECjKiefx7OaSaiZfALofdpiaZAsAgdq/f F37UyO1Rs3HRM+9ud56aNRFMHbpQ6EDXEr+Pie5GArwvB3W4exhpqMnuVjB6TRnTDBGocqp+Txz Loj5Avzg9QbUki3wbrKxgtA3siLy2tel2hSoXMdR3G9XLQgyaBZHuhb1Mr0g== X-Google-Smtp-Source: AGHT+IGLnWr4d92zVMT5YsA/Qbx6kvK+tKux2OD9+pZPh56wH0AKH1FiR/agij/L6d0GQ6YSXnQ4+Q== X-Received: by 2002:a05:7301:707:b0:2a4:3592:cf6c with SMTP id 5a478bee46e88-2b05ec1467emr27353306eec.16.1767377248445; Fri, 02 Jan 2026 10:07:28 -0800 (PST) Received: from smtpclient.apple ([2804:14d:1c70:8963:9989:eaad:ee69:ab08]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-2b140c42ecfsm1576244eec.25.2026.01.02.10.07.27 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 02 Jan 2026 10:07:28 -0800 (PST) From: Marcos Magueta Message-Id: <89DE974B-F318-4D0A-A60B-51EDE84054E2@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_6079A500-3B0A-43AA-9990-97A8D27C66E6" Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.300.41.1.7\)) Subject: Re: WIP - xmlvalidate implementation from TODO list Date: Fri, 2 Jan 2026 15:07:24 -0300 In-Reply-To: Cc: PostgreSQL Hackers To: Kirill Reshke References: X-Mailer: Apple Mail (2.3864.300.41.1.7) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --Apple-Mail=_6079A500-3B0A-43AA-9990-97A8D27C66E6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 1 Jan 2026, at 05:25, Kirill Reshke wrote: >=20 >=20 >=20 > On Thu, 1 Jan 2026, 01:27 Marcos Magueta, > wrote: >> Hello again! >>=20 >> Is there any interest in this? I understand PostgreSQL has bigger = fish to fry, but I would like to at least know; in case this was just = forgotten. >>=20 >> Regards! >>=20 >> Em sex., 19 de dez. de 2025 =C3=A0s 00:25, Marcos Magueta = > escreveu: >>> Hello again! >>>=20 >>> I took some time to actually finish this feature. I think the = answers >>> for the previous questions are now clearer. I checked the >>> initialization and the protections are indeed in place since commit >>> a4b0c0aaf093a015bebe83a24c183e10a66c8c39, which specifically states: >>>=20 >>> > Prevent access to external files/URLs via XML entity references. >>>=20 >>> > xml_parse() would attempt to fetch external files or URLs as = needed to >>> > resolve DTD and entity references in an XML value, thus allowing >>> > unprivileged database users to attempt to fetch data with the = privileges >>> > of the database server. While the external data wouldn't get = returned >>> > directly to the user, portions of it could be exposed in error = messages >>> > if the data didn't parse as valid XML; and in any case the mere = ability >>> > to check existence of a file might be useful to an attacker. >>> >=20 >>> > The ideal solution to this would still allow fetching of = references that >>> > are listed in the host system's XML catalogs, so that documents = can be >>> > validated according to installed DTDs. However, doing that with = the >>> > available libxml2 APIs appears complex and error-prone, so we're = not going >>> > to risk it in a security patch that necessarily hasn't gotten wide = review. >>> > So this patch merely shuts off all access, causing any external = fetch to >>> > silently expand to an empty string. A future patch may improve = this. >>>=20 >>> With that, the obvious affordance on the xmlvalidate implementation >>> was to not rely on external schema sources on the host >>> catalog. Therefore the implementation relies solely on expressions >>> that necessarily evaluate to a schema in plain text. >>>=20 >>> I added the requested documentation and a bunch of tests for each >>> scenario. I would appreciate another round of reviews whenever = someone >>> has the time and patience. >>>=20 >>> At last, to nourish the curiosity: I had issues with make check, as >>> stated above on the e-mail thread. These got resolved when I changed >>> `execl` to `execlp` on `pg_regress.c`. I of course did not commit >>> such, but more people I know have had the very same issue while >>> relying on immutable package managers. >=20 >=20 > Hi! > First of all, please do not top post =F0=9F=99=8F . Use down-posting. >=20 > About general interest in feature - I suspect that we as a community = generally interested in implementing items from TODO list. This feature = also increases SQL standard compatibility. But I am myself not a big = SQL/XML user, so I can only give limited review here. I also did not = have much time last month. I will try to find my cycles to give another = look here.=20 Thank you very much for reaching back. Sorry about the bad e-mail = etiquette, hopefully it=E2=80=99s corrected now. About the patch, let me know if you find the time to review! Thanks once again! --Apple-Mail=_6079A500-3B0A-43AA-9990-97A8D27C66E6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On 1 Jan 2026, at 05:25, Kirill Reshke = <reshkekirill@gmail.com> wrote:



On Thu, 1 = Jan 2026, 01:27 Marcos Magueta, <maguetamarcos@gmail.com> = wrote:
Hello again!

Is there any interest in = this? I understand PostgreSQL has bigger fish to fry, but I would like = to at least know; in case this was just = forgotten.

Regards!

Em sex., 19 de dez. de 2025 =C3=A0s = 00:25, Marcos Magueta <maguetamarcos@gmail.com> = escreveu:
Hello = again!

I took some time to actually finish this feature. I think = the answers
for the previous questions are now clearer. I checked = the
initialization and the protections are indeed in place since = commit
a4b0c0aaf093a015bebe83a24c183e10a66c8c39, which specifically = states:

> Prevent access to external files/URLs via XML entity = references.

> xml_parse() would attempt to fetch external = files or URLs as needed to
> resolve DTD and entity references in = an XML value, thus allowing
> unprivileged database users to = attempt to fetch data with the privileges
> of the database = server.  While the external data wouldn't get returned
> = directly to the user, portions of it could be exposed in error = messages
> if the data didn't parse as valid XML; and in any case = the mere ability
> to check existence of a file might be useful to = an attacker.
>
> The ideal solution to this would still = allow fetching of references that
> are listed in the host = system's XML catalogs, so that documents can be
> validated = according to installed DTDs.  However, doing that with the
> = available libxml2 APIs appears complex and error-prone, so we're not = going
> to risk it in a security patch that necessarily hasn't = gotten wide review.
> So this patch merely shuts off all access, = causing any external fetch to
> silently expand to an empty = string.  A future patch may improve this.

With that, the = obvious affordance on the xmlvalidate implementation
was to not rely = on external schema sources on the host
catalog. Therefore the = implementation relies solely on expressions
that necessarily evaluate = to a schema in plain text.

I added the requested documentation = and a bunch of tests for each
scenario. I would appreciate another = round of reviews whenever someone
has the time and = patience.

At last, to nourish the curiosity: I had issues with = make check, as
stated above on the e-mail thread. These got resolved = when I changed
`execl` to `execlp` on `pg_regress.c`. I of course did = not commit
such, but more people I know have had the very same issue = while
relying on immutable package managers.


Hi!
First = of all, please do not top post  =F0=9F=99=8F . Use = down-posting.

About general interest in feature - I = suspect that we as a community generally interested in implementing = items from TODO list. This feature also increases SQL standard = compatibility. But I am myself not a big SQL/XML user, so I can only = give limited review here. I also did not have much time last month. I = will try to find my cycles to give another look = here. 

Thank you very much for reaching back. = Sorry about the bad e-mail etiquette, hopefully it=E2=80=99s corrected = now.

About the patch, let me know if you find = the time to review!

Thanks once = again!

= --Apple-Mail=_6079A500-3B0A-43AA-9990-97A8D27C66E6--