database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-12-19 17:02:53 +03:00
Code Activity

Restrict psql meta-commands in plain-text dumps.

Browse Source 
A malicious server could inject psql meta-commands into plain-text
dump output (i.e., scripts created with pg_dump --format=plain,
pg_dumpall, or pg_restore --file) that are run at restore time on
the machine running psql.  To fix, introduce a new "restricted"
mode in psql that blocks all meta-commands (except for \unrestrict
to exit the mode), and teach pg_dump, pg_dumpall, and pg_restore to
use this mode in plain-text dumps.

While at it, encourage users to only restore dumps generated from
trusted servers or to inspect it beforehand, since restoring causes
the destination to execute arbitrary code of the source superusers'
choice.  However, the client running the dump and restore needn't
trust the source or destination superusers.

Reported-by: Martin Rakhmanov
Reported-by: Matthieu Denais <litezeraw@gmail.com>
Reported-by: RyotaK <ryotak.mail@gmail.com>
Suggested-by: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Noah Misch <noah@leadboat.com>
Reviewed-by: Michael Paquier <michael@paquier.xyz>
Reviewed-by: Peter Eisentraut <peter@eisentraut.org>
Security: CVE-2025-8714
Backpatch-through: 13
This commit is contained in:
Nathan Bossart
2025-08-11 09:00:00 -05:00
parent 70693c645f
commit 71ea0d6795
22 changed files with 435 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/test/recovery/t/027_stream_regress.pl
View File

@@ -117,6 +117,7 @@ command_ok(
'pg_dumpall',
'--file' => $outputdir . '/primary.dump',
'--no-sync', '--no-statistics',
'--restrict-key=test',
'--port' => $node_primary->port,
'--no-unlogged-table-data', # if unlogged, standby has schema only
],
@@ -126,6 +127,7 @@ command_ok(
'pg_dumpall',
'--file' => $outputdir . '/standby.dump',
'--no-sync', '--no-statistics',
'--restrict-key=test',
'--port' => $node_standby_1->port,
],
'dump standby server');
@@ -145,6 +147,7 @@ command_ok(
'--schema' => 'pg_catalog',
'--file' => $outputdir . '/catalogs_primary.dump',
'--no-sync',
'--restrict-key=test',
'--port', $node_primary->port,
'--no-unlogged-table-data',
'regression',
@@ -156,6 +159,7 @@ command_ok(
'--schema' => 'pg_catalog',
'--file' => $outputdir . '/catalogs_standby.dump',
'--no-sync',
'--restrict-key=test',
'--port' => $node_standby_1->port,
'regression',
],

2
src/test/regress/expected/psql.out
View File

@@ -4705,6 +4705,7 @@ invalid command \lo
\pset arg1 arg2
\q
\reset
\restrict test
\s arg1
\sendpipeline
\set arg1 arg2 arg3 arg4 arg5 arg6 arg7
@@ -4716,6 +4717,7 @@ invalid command \lo
\t arg1
\T arg1
\timing arg1
\unrestrict not_valid
\unset arg1
\w arg1
\watch arg1 arg2

2
src/test/regress/sql/psql.sql
View File

@@ -1073,6 +1073,7 @@ select \if false \\ (bogus \else \\ 42 \endif \\ forty_two;
\pset arg1 arg2
\q
\reset
\restrict test
\s arg1
\sendpipeline
\set arg1 arg2 arg3 arg4 arg5 arg6 arg7
@@ -1084,6 +1085,7 @@ select \if false \\ (bogus \else \\ 42 \endif \\ forty_two;
\t arg1
\T arg1
\timing arg1
\unrestrict not_valid
\unset arg1
\w arg1
\watch arg1 arg2