From ffa2d37e5fbd1243f918f622113d6e371667e5a0 Mon Sep 17 00:00:00 2001 From: Noah Misch Date: Mon, 5 Aug 2019 07:48:41 -0700 Subject: Require the schema qualification in pg_temp.type_name(arg). Commit aa27977fe21a7dfa4da4376ad66ae37cb8f0d0b5 introduced this restriction for pg_temp.function_name(arg); do likewise for types created in temporary schemas. Programs that this breaks should add "pg_temp." schema qualification or switch to arg::type_name syntax. Back-patch to 9.4 (all supported versions). Reviewed by Tom Lane. Reported by Tom Lane. Security: CVE-2019-10208 --- src/backend/utils/adt/ruleutils.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'src/backend/utils/adt/ruleutils.c') diff --git a/src/backend/utils/adt/ruleutils.c b/src/backend/utils/adt/ruleutils.c index 54816dc0287..13d5d542f94 100644 --- a/src/backend/utils/adt/ruleutils.c +++ b/src/backend/utils/adt/ruleutils.c @@ -9475,6 +9475,14 @@ get_coercion_expr(Node *arg, deparse_context *context, if (!PRETTY_PAREN(context)) appendStringInfoChar(buf, ')'); } + + /* + * Never emit resulttype(arg) functional notation. A pg_proc entry could + * take precedence, and a resulttype in pg_temp would require schema + * qualification that format_type_with_typemod() would usually omit. We've + * standardized on arg::resulttype, but CAST(arg AS resulttype) notation + * would work fine. + */ appendStringInfo(buf, "::%s", format_type_with_typemod(resulttype, resulttypmod)); } -- cgit v1.2.3