diff options
| author | Peter Eisentraut <peter_e@gmx.net> | 2017-05-05 12:18:48 -0400 |
|---|---|---|
| committer | Peter Eisentraut <peter_e@gmx.net> | 2017-05-08 09:18:57 -0400 |
| commit | c33c42362256382ed398df9dcda559cd547c68a7 (patch) | |
| tree | 871e8ddfae2f626eda33b1fef8b177c97798d92d /src/include | |
| parent | 3178f467c81823954f76603a03ad3edb7f54f588 (diff) | |
| download | postgresql-c33c42362256382ed398df9dcda559cd547c68a7.tar.gz postgresql-c33c42362256382ed398df9dcda559cd547c68a7.zip | |
Add security checks to selectivity estimation functions
Some selectivity estimation functions run user-supplied operators over
data obtained from pg_statistic without security checks, which allows
those operators to leak pg_statistic data without having privileges on
the underlying tables. Fix by checking that one of the following is
satisfied: (1) the user has table or column privileges on the table
underlying the pg_statistic data, or (2) the function implementing the
user-supplied operator is leak-proof. If neither is satisfied, planning
will proceed as if there are no statistics available.
At least one of these is satisfied in most cases in practice. The only
situations that are negatively impacted are user-defined or
not-leak-proof operators on a security-barrier view.
Reported-by: Robert Haas <robertmhaas@gmail.com>
Author: Peter Eisentraut <peter_e@gmx.net>
Author: Tom Lane <tgl@sss.pgh.pa.us>
Security: CVE-2017-7484
Diffstat (limited to 'src/include')
| -rw-r--r-- | src/include/utils/selfuncs.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/include/utils/selfuncs.h b/src/include/utils/selfuncs.h index 8e0d3174687..61233aed7a6 100644 --- a/src/include/utils/selfuncs.h +++ b/src/include/utils/selfuncs.h @@ -75,6 +75,7 @@ typedef struct VariableStatData Oid atttype; /* type to pass to get_attstatsslot */ int32 atttypmod; /* typmod to pass to get_attstatsslot */ bool isunique; /* matches unique index or DISTINCT clause */ + bool acl_ok; /* result of ACL check on table or column */ } VariableStatData; #define ReleaseVariableStats(vardata) \ @@ -153,6 +154,7 @@ extern PGDLLIMPORT get_index_stats_hook_type get_index_stats_hook; extern void examine_variable(PlannerInfo *root, Node *node, int varRelid, VariableStatData *vardata); +extern bool statistic_proc_security_check(VariableStatData *vardata, Oid func_oid); extern bool get_restriction_variable(PlannerInfo *root, List *args, int varRelid, VariableStatData *vardata, Node **other, |