agora inbox for pgsql-sql@postgresql.org  

help / color / mirror / Atom feed

From: Tom Lane <tgl@sss.pgh.pa.us>
To: Ben Tilly <btilly@gmail.com>
Cc: pgsql-sql@lists.postgresql.org
Subject: Re: Is this a security oversight?
Date: Tue, 10 Aug 2021 14:32:10 -0400
Message-ID: <3825125.1628620330@sss.pgh.pa.us> (raw)
In-Reply-To: <CANoac9V3t2LerZ8x3gt-UDeLWJntreBysXM6NrDurpGcXA9+fw@mail.gmail.com>
References: <CANoac9V3t2LerZ8x3gt-UDeLWJntreBysXM6NrDurpGcXA9+fw@mail.gmail.com>

Ben Tilly <btilly@gmail.com> writes:
> As a security rule, you cannot create a cast without owning one of the
> types.

Check.

> The following code successfully creates it, not as postgres and not as a
> superuser.

Really?  When I try that as an ordinary user, I get

ERROR:  must be owner of type boolean
CONTEXT:  SQL statement "ALTER TYPE bool OWNER TO current_user"
PL/pgSQL function inline_code_block line 12 at SQL statement

If there is a way where that actually does work without superuser
privileges, please send the details to security@postgresql.org.

			regards, tom lane

view thread (4+ messages)  latest in thread

Message-ID: <3825125.1628620330@sss.pgh.pa.us>
Permalink:  ../3825125.1628620330@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/3825125.1628620330@sss.pgh.pa.us

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-sql@postgresql.org
  Cc: tgl@sss.pgh.pa.us, btilly@gmail.com, pgsql-sql@lists.postgresql.org
  Subject: Re: Is this a security oversight?
  In-Reply-To: <3825125.1628620330@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox