database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-06-29 10:41:53 +03:00
Code Activity

Always require SELECT permission for ON CONFLICT DO UPDATE.

Browse Source 
The update path of an INSERT ... ON CONFLICT DO UPDATE requires SELECT
permission on the columns of the arbiter index, but it failed to check
for that in the case of an arbiter specified by constraint name.

In addition, for a table with row level security enabled, it failed to
check updated rows against the table's SELECT policies when the update
path was taken (regardless of how the arbiter index was specified).

Backpatch to 9.5 where ON CONFLICT DO UPDATE and RLS were introduced.

Security: CVE-2017-15099
This commit is contained in:
Dean Rasheed
2017-11-06 09:19:22 +00:00
parent c66b438db6
commit 87b2ebd352
8 changed files with 194 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/backend/parser/parse_clause.c
View File

@ -3164,9 +3164,26 @@ transformOnConflictArbiter(ParseState *pstate,
pstate->p_namespace = save_namespace;
/*
* If the arbiter is specified by constraint name, get the constraint
* OID and mark the constrained columns as requiring SELECT privilege,
* in the same way as would have happened if the arbiter had been
* specified by explicit reference to the constraint's index columns.
*/
if (infer->conname)
*constraint = get_relation_constraint_oid(RelationGetRelid(pstate->p_target_relation),
infer->conname, false);
{
Oid relid = RelationGetRelid(pstate->p_target_relation);
RangeTblEntry *rte = pstate->p_target_rangetblentry;
Bitmapset *conattnos;
conattnos = get_relation_constraint_attnos(relid, infer->conname,
false, constraint);
/* Make sure the rel as a whole is marked for SELECT access */
rte->requiredPerms |= ACL_SELECT;
/* Mark the constrained columns as requiring SELECT access */
rte->selectedCols = bms_add_members(rte->selectedCols, conattnos);
}
}
/*