From: Tom Lane <tgl@sss.pgh.pa.us>
To: Ben Tilly <btilly@gmail.com>
cc: pgsql-sql@lists.postgresql.org
Subject: Re: Is this a security oversight?
In-reply-to: 
 <CANoac9V3t2LerZ8x3gt-UDeLWJntreBysXM6NrDurpGcXA9+fw@mail.gmail.com>
References: 
 <CANoac9V3t2LerZ8x3gt-UDeLWJntreBysXM6NrDurpGcXA9+fw@mail.gmail.com>
Comments: In-reply-to Ben Tilly <btilly@gmail.com>
	message dated "Tue, 10 Aug 2021 10:41:48 -0700"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3825124.1628620330.1@sss.pgh.pa.us>
Date: Tue, 10 Aug 2021 14:32:10 -0400
Message-ID: <3825125.1628620330@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/3825125.1628620330%40sss.pgh.pa.us>
Precedence: bulk

Ben Tilly <btilly@gmail.com> writes:
> As a security rule, you cannot create a cast without owning one of the
> types.

Check.

> The following code successfully creates it, not as postgres and not as a
> superuser.

Really?  When I try that as an ordinary user, I get

ERROR:  must be owner of type boolean
CONTEXT:  SQL statement "ALTER TYPE bool OWNER TO current_user"
PL/pgSQL function inline_code_block line 12 at SQL statement

If there is a way where that actually does work without superuser
privileges, please send the details to security@postgresql.org.

			regards, tom lane