MIME-Version: 1.0
References: 
 <CAN3aFCdx8AapWSVpJ1kaC7OC_v7QwbjgbGw9WfPBBY2GMyOadQ@mail.gmail.com>
 <CALdSSPjxLU+zhWx+CgwN+VHoHTso33trY6mse1A6Jks7hWAdrA@mail.gmail.com>
 <CAN3aFCesNDiL-iZg4imC0n+NgT3JywqZYkuGH83u8ssLjJ-p5Q@mail.gmail.com>
 <CAN3aFCfvVgXr77o=dB_E2kSCY+EgckSQbSBdd_N9n-LauWuQLw@mail.gmail.com>
In-Reply-To: 
 <CAN3aFCfvVgXr77o=dB_E2kSCY+EgckSQbSBdd_N9n-LauWuQLw@mail.gmail.com>
From: Marcos Magueta <maguetamarcos@gmail.com>
Date: Wed, 31 Dec 2025 17:26:55 -0300
Message-ID: 
 <CAN3aFCcx_w5Ldb+SYurwd31es9hOJqLuKARQHHDOk7+5iOqBWQ@mail.gmail.com>
Subject: Re: WIP - xmlvalidate implementation from TODO list
To: Kirill Reshke <reshkekirill@gmail.com>
Cc: pgsql-hackers@lists.postgresql.org
Content-Type: multipart/alternative; boundary="000000000000cb810c0647454cd8"
Archived-At: 
 <https://www.postgresql.org/message-id/CAN3aFCcx_w5Ldb%2BSYurwd31es9hOJqLuKARQHHDOk7%2B5iOqBWQ%40mail.gmail.com>
Precedence: bulk

--000000000000cb810c0647454cd8
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello again!

Is there any interest in this? I understand PostgreSQL has bigger fish to
fry, but I would like to at least know; in case this was just forgotten.

Regards!

Em sex., 19 de dez. de 2025 =C3=A0s 00:25, Marcos Magueta <
maguetamarcos@gmail.com> escreveu:

> Hello again!
>
> I took some time to actually finish this feature. I think the answers
> for the previous questions are now clearer. I checked the
> initialization and the protections are indeed in place since commit
> a4b0c0aaf093a015bebe83a24c183e10a66c8c39, which specifically states:
>
> > Prevent access to external files/URLs via XML entity references.
>
> > xml_parse() would attempt to fetch external files or URLs as needed to
> > resolve DTD and entity references in an XML value, thus allowing
> > unprivileged database users to attempt to fetch data with the privilege=
s
> > of the database server.  While the external data wouldn't get returned
> > directly to the user, portions of it could be exposed in error messages
> > if the data didn't parse as valid XML; and in any case the mere ability
> > to check existence of a file might be useful to an attacker.
> >
> > The ideal solution to this would still allow fetching of references tha=
t
> > are listed in the host system's XML catalogs, so that documents can be
> > validated according to installed DTDs.  However, doing that with the
> > available libxml2 APIs appears complex and error-prone, so we're not
> going
> > to risk it in a security patch that necessarily hasn't gotten wide
> review.
> > So this patch merely shuts off all access, causing any external fetch t=
o
> > silently expand to an empty string.  A future patch may improve this.
>
> With that, the obvious affordance on the xmlvalidate implementation
> was to not rely on external schema sources on the host
> catalog. Therefore the implementation relies solely on expressions
> that necessarily evaluate to a schema in plain text.
>
> I added the requested documentation and a bunch of tests for each
> scenario. I would appreciate another round of reviews whenever someone
> has the time and patience.
>
> At last, to nourish the curiosity: I had issues with make check, as
> stated above on the e-mail thread. These got resolved when I changed
> `execl` to `execlp` on `pg_regress.c`. I of course did not commit
> such, but more people I know have had the very same issue while
> relying on immutable package managers.
>

--000000000000cb810c0647454cd8
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div>Hello again!<br></div><br>Is there any interest =
in this? I understand PostgreSQL has bigger fish to fry, but I would like t=
o at least know; in case this was just forgotten.<br><br></div>Regards!</di=
v><br><div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" cla=
ss=3D"gmail_attr">Em sex., 19 de dez. de 2025 =C3=A0s 00:25, Marcos Magueta=
 &lt;<a href=3D"mailto:maguetamarcos@gmail.com">maguetamarcos@gmail.com</a>=
&gt; escreveu:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0=
px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><=
div dir=3D"ltr">Hello again!<br><br>I took some time to actually finish thi=
s feature. I think the answers<br>for the previous questions are now cleare=
r. I checked the<br>initialization and the protections are indeed in place =
since commit<br>a4b0c0aaf093a015bebe83a24c183e10a66c8c39, which specificall=
y states:<br><br>&gt; Prevent access to external files/URLs via XML entity =
references.<br><br>&gt; xml_parse() would attempt to fetch external files o=
r URLs as needed to<br>&gt; resolve DTD and entity references in an XML val=
ue, thus allowing<br>&gt; unprivileged database users to attempt to fetch d=
ata with the privileges<br>&gt; of the database server.=C2=A0 While the ext=
ernal data wouldn&#39;t get returned<br>&gt; directly to the user, portions=
 of it could be exposed in error messages<br>&gt; if the data didn&#39;t pa=
rse as valid XML; and in any case the mere ability<br>&gt; to check existen=
ce of a file might be useful to an attacker.<br>&gt; <br>&gt; The ideal sol=
ution to this would still allow fetching of references that<br>&gt; are lis=
ted in the host system&#39;s XML catalogs, so that documents can be<br>&gt;=
 validated according to installed DTDs.=C2=A0 However, doing that with the<=
br>&gt; available libxml2 APIs appears complex and error-prone, so we&#39;r=
e not going<br>&gt; to risk it in a security patch that necessarily hasn=
9;t gotten wide review.<br>&gt; So this patch merely shuts off all access, =
causing any external fetch to<br>&gt; silently expand to an empty string.=
=C2=A0 A future patch may improve this.<br><br>With that, the obvious affor=
dance on the xmlvalidate implementation<br>was to not rely on external sche=
ma sources on the host<br>catalog. Therefore the implementation relies sole=
ly on expressions<br>that necessarily evaluate to a schema in plain text.<b=
r><br>I added the requested documentation and a bunch of tests for each<br>=
scenario. I would appreciate another round of reviews whenever someone<br>h=
as the time and patience.<br><br>At last, to nourish the curiosity: I had i=
ssues with make check, as<br>stated above on the e-mail thread. These got r=
esolved when I changed<br>`execl` to `execlp` on `pg_regress.c`. I of cours=
e did not commit<br>such, but more people I know have had the very same iss=
ue while<br>relying on immutable package managers.</div>
</blockquote></div>

--000000000000cb810c0647454cd8--