database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-10-23 13:29:09 +03:00
Code Activity

Check for USAGE privilege on the composite type in ALTER TABLE OF.

Browse Source 
This omission allowed roles without USAGE on a type to create
tables that depend on it, which could prevent the owner from
changing the type later.

Reported-by: Nathan Bossart <nathandbossart@gmail.com>
Author: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Robert Haas <robertmhaas@gmail.com>
Security: CVE-2026-6470
Backpatch-through: 14
This commit is contained in:
Nathan Bossart
2026-08-10 06:38:25 -07:00
committed by Noah Misch
parent 7ce056b179
commit 7a761fe408
3 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/backend/commands/tablecmds.c
View File

@@ -16083,6 +16083,7 @@ ATExecAddOf(Relation rel, const TypeName *ofTypename, LOCKMODE lockmode)
ObjectAddress tableobj,
typeobj;
HeapTuple classtuple;
AclResult aclresult;
/* Validate the type. */
typetuple = typenameType(NULL, ofTypename, NULL);
@@ -16090,6 +16091,10 @@ ATExecAddOf(Relation rel, const TypeName *ofTypename, LOCKMODE lockmode)
typeform = (Form_pg_type) GETSTRUCT(typetuple);
typeid = typeform->oid;
aclresult = object_aclcheck(TypeRelationId, typeid, GetUserId(), ACL_USAGE);
if (aclresult != ACLCHECK_OK)
aclcheck_error_type(aclresult, typeid);
/* Fail if the table has any inheritance parents. */
inheritsRelation = table_open(InheritsRelationId, AccessShareLock);
ScanKeyInit(&key,

6
src/test/regress/expected/privileges.out
View File

@@ -1335,6 +1335,9 @@ CREATE TABLE test5a (a int, b priv_testdomain1);
ERROR: permission denied for type priv_testdomain1
CREATE TABLE test6a OF priv_testtype1;
ERROR: permission denied for type priv_testtype1
CREATE TABLE test6a2 (a int, b text);
ALTER TABLE test6a2 OF priv_testtype1;
ERROR: permission denied for type priv_testtype1
CREATE TABLE test10a (a int[], b priv_testtype1[]);
ERROR: permission denied for type priv_testtype1
CREATE TABLE test9a (a int, b int);
@@ -1382,6 +1385,8 @@ CREATE FUNCTION priv_testfunc7b(a int DEFAULT ('(0,1)'::priv_testtype1).a) RETUR
CREATE OPERATOR !! (PROCEDURE = priv_testfunc5b, RIGHTARG = priv_testdomain1);
CREATE TABLE test5b (a int, b priv_testdomain1);
CREATE TABLE test6b OF priv_testtype1;
CREATE TABLE test6b2 (a int, b text);
ALTER TABLE test6b2 OF priv_testtype1;
CREATE TABLE test10b (a int[], b priv_testtype1[]);
CREATE TABLE test9b (a int, b int);
ALTER TABLE test9b ADD COLUMN c priv_testdomain1;
@@ -1423,6 +1428,7 @@ DROP FUNCTION priv_testfunc6b(b int);
DROP FUNCTION priv_testfunc7b(a int);
DROP TABLE test5b;
DROP TABLE test6b;
DROP TABLE test6b2;
DROP TABLE test9b;
DROP TABLE test10b;
DROP TYPE test7b;

5
src/test/regress/sql/privileges.sql
View File

@@ -941,6 +941,8 @@ CREATE OPERATOR !+! (PROCEDURE = int4pl, LEFTARG = priv_testdomain1, RIGHTARG =
CREATE TABLE test5a (a int, b priv_testdomain1);
CREATE TABLE test6a OF priv_testtype1;
CREATE TABLE test6a2 (a int, b text);
ALTER TABLE test6a2 OF priv_testtype1;
CREATE TABLE test10a (a int[], b priv_testtype1[]);
CREATE TABLE test9a (a int, b int);
@@ -989,6 +991,8 @@ CREATE OPERATOR !! (PROCEDURE = priv_testfunc5b, RIGHTARG = priv_testdomain1);
CREATE TABLE test5b (a int, b priv_testdomain1);
CREATE TABLE test6b OF priv_testtype1;
CREATE TABLE test6b2 (a int, b text);
ALTER TABLE test6b2 OF priv_testtype1;
CREATE TABLE test10b (a int[], b priv_testtype1[]);
CREATE TABLE test9b (a int, b int);
@@ -1036,6 +1040,7 @@ DROP FUNCTION priv_testfunc6b(b int);
DROP FUNCTION priv_testfunc7b(a int);
DROP TABLE test5b;
DROP TABLE test6b;
DROP TABLE test6b2;
DROP TABLE test9b;
DROP TABLE test10b;
DROP TYPE test7b;