database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-28 23:42:10 +03:00
Code Activity

Restrict virtual columns to use built-in functions and types

Browse Source 
Just like selecting from a view is exploitable (CVE-2024-7348),
selecting from a table with virtual generated columns is exploitable.
Users who are concerned about this can avoid selecting from views, but
telling them to avoid selecting from tables is less practical.

To address this, this changes it so that generation expressions for
virtual generated columns are restricted to using built-in functions
and types, and the columns are restricted to having a built-in type.
We assume that built-in functions and types cannot be exploited for
this purpose.

In the future, this could be expanded by some new mechanism to declare
other functions and types as safe or trusted for this purpose, but
that is to be designed.

(An alternative approach might have been to expand the
restrict_nonsystem_relation_kind GUC to handle this, like the fix for
CVE-2024-7348.  But that is kind of an ugly approach.  That fix had to
fit in the constraints of fixing an ancient vulnerability in all
branches.  Since virtual generated columns are new, we're free from
the constraints of the past, and we can and should use cleaner
options.)

Reported-by: Feike Steenbergen <feikesteenbergen@gmail.com>
Reviewed-by: jian he <jian.universality@gmail.com>
Discussion: https://www.postgresql.org/message-id/flat/CAK_s-G2Q7de8Q0qOYUR%3D_CTB5FzzVBm5iZjOp%2BmeVWpMpmfO0w%40mail.gmail.com
This commit is contained in:
Peter Eisentraut
2025-06-25 09:55:04 +02:00
parent 69e5cdc47f
commit 0cd69b3d7e
8 changed files with 163 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
doc/src/sgml/ddl.sgml
View File

@ -419,6 +419,16 @@ CREATE TABLE people (
<varname>tableoid</varname>.
</para>
</listitem>
<listitem>
<para>
A virtual generated column cannot have a user-defined type, and the
generation expression of a virtual generated column must not reference
user-defined functions or types, that is, it can only use built-in
functions or types. This applies also indirectly, such as for functions
or types that underlie operators or casts. (This restriction does not
exist for stored generated columns.)
</para>
</listitem>
<listitem>
<para>
A generated column cannot have a column default or an identity definition.

9
doc/src/sgml/ref/create_table.sgml
View File

@ -924,6 +924,15 @@ WITH ( MODULUS <replaceable class="parameter">numeric_literal</replaceable>, REM
not other generated columns. Any functions and operators used must be
immutable. References to other tables are not allowed.
</para>
<para>
A virtual generated column cannot have a user-defined type, and the
generation expression of a virtual generated column must not reference
user-defined functions or types, that is, it can only use built-in
functions or types. This applies also indirectly, such as for functions
or types that underlie operators or casts. (This restriction does not
exist for stored generated columns.)
</para>
</listitem>
</varlistentry>