database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-11-24 00:23:06 +03:00
Code Activity

Check for CREATE privilege on the schema in CREATE STATISTICS.

Browse Source 
This omission allowed table owners to create statistics in any
schema, potentially leading to unexpected naming conflicts.  For
ALTER TABLE commands that require re-creating statistics objects,
skip this check in case the user has since lost CREATE on the
schema.  The addition of a second parameter to CreateStatistics()
breaks ABI compatibility, but we are unaware of any impacted
third-party code.

Reported-by: Jelte Fennema-Nio <postgres@jeltef.nl>
Author: Jelte Fennema-Nio <postgres@jeltef.nl>
Co-authored-by: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Noah Misch <noah@leadboat.com>
Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de>
Security: CVE-2025-12817
Backpatch-through: 13
This commit is contained in:
Nathan Bossart
2025-11-10 09:00:00 -06:00
parent d6f0c0d6d6
commit 8a2530ebcd
3 changed files with 35 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/backend/commands/statscmds.c
View File

@@ -33,6 +33,7 @@
#include "utils/builtins.h" #include "utils/builtins.h"
#include "utils/fmgroids.h" #include "utils/fmgroids.h"
#include "utils/inval.h" #include "utils/inval.h"
#include "utils/lsyscache.h"
#include "utils/memutils.h" #include "utils/memutils.h"
#include "utils/rel.h" #include "utils/rel.h"
#include "utils/syscache.h" #include "utils/syscache.h"
@@ -89,6 +90,7 @@ CreateStatistics(CreateStatsStmt *stmt)
bool requested_type = false; bool requested_type = false;
int i; int i;
ListCell *cell; ListCell *cell;
AclResult aclresult;
Assert(IsA(stmt, CreateStatsStmt)); Assert(IsA(stmt, CreateStatsStmt));
@@ -167,6 +169,12 @@ CreateStatistics(CreateStatsStmt *stmt)
} }
namestrcpy(&stxname, namestr); namestrcpy(&stxname, namestr);
/* Check we have creation rights in target namespace. */
aclresult = pg_namespace_aclcheck(namespaceId, GetUserId(), ACL_CREATE);
if (aclresult != ACLCHECK_OK)
aclcheck_error(aclresult, OBJECT_SCHEMA,
get_namespace_name(namespaceId));
/* /*
* Deal with the possibility that the statistics object already exists. * Deal with the possibility that the statistics object already exists.
*/ */

14
src/test/regress/expected/stats_ext.out
View File

@@ -1745,6 +1745,18 @@ SELECT * FROM tststats.priv_test_parent_tbl t
(0 rows) (0 rows)
DELETE FROM tststats.priv_test_parent_tbl WHERE a <<< 0 AND b <<< 0; -- Should not leak DELETE FROM tststats.priv_test_parent_tbl WHERE a <<< 0 AND b <<< 0; -- Should not leak
-- CREATE STATISTICS checks for CREATE on the schema
RESET SESSION AUTHORIZATION;
CREATE SCHEMA sts_sch1 CREATE TABLE sts_sch1.tbl (a INT, b INT);
GRANT USAGE ON SCHEMA sts_sch1 TO regress_stats_user1;
ALTER TABLE sts_sch1.tbl OWNER TO regress_stats_user1;
SET SESSION AUTHORIZATION regress_stats_user1;
CREATE STATISTICS sts_sch1.fail ON a, b FROM sts_sch1.tbl;
ERROR: permission denied for schema sts_sch1
RESET SESSION AUTHORIZATION;
GRANT CREATE ON SCHEMA sts_sch1 TO regress_stats_user1;
SET SESSION AUTHORIZATION regress_stats_user1;
CREATE STATISTICS sts_sch1.pass ON a, b FROM sts_sch1.tbl;
-- Tidy up -- Tidy up
DROP OPERATOR <<< (int, int); DROP OPERATOR <<< (int, int);
DROP FUNCTION op_leak(int, int); DROP FUNCTION op_leak(int, int);
@@ -1756,4 +1768,6 @@ NOTICE: drop cascades to 3 other objects
DETAIL: drop cascades to table tststats.priv_test_parent_tbl DETAIL: drop cascades to table tststats.priv_test_parent_tbl
drop cascades to table tststats.priv_test_tbl drop cascades to table tststats.priv_test_tbl
drop cascades to view tststats.priv_test_view drop cascades to view tststats.priv_test_view
DROP SCHEMA sts_sch1 CASCADE;
NOTICE: drop cascades to table sts_sch1.tbl
DROP USER regress_stats_user1; DROP USER regress_stats_user1;

13
src/test/regress/sql/stats_ext.sql
View File

@@ -963,6 +963,18 @@ SELECT * FROM tststats.priv_test_parent_tbl t
WHERE a <<< 0 AND (b <<< 0 OR t.* <<< (1, 1) IS NOT NULL); -- Should not leak WHERE a <<< 0 AND (b <<< 0 OR t.* <<< (1, 1) IS NOT NULL); -- Should not leak
DELETE FROM tststats.priv_test_parent_tbl WHERE a <<< 0 AND b <<< 0; -- Should not leak DELETE FROM tststats.priv_test_parent_tbl WHERE a <<< 0 AND b <<< 0; -- Should not leak
-- CREATE STATISTICS checks for CREATE on the schema
RESET SESSION AUTHORIZATION;
CREATE SCHEMA sts_sch1 CREATE TABLE sts_sch1.tbl (a INT, b INT);
GRANT USAGE ON SCHEMA sts_sch1 TO regress_stats_user1;
ALTER TABLE sts_sch1.tbl OWNER TO regress_stats_user1;
SET SESSION AUTHORIZATION regress_stats_user1;
CREATE STATISTICS sts_sch1.fail ON a, b FROM sts_sch1.tbl;
RESET SESSION AUTHORIZATION;
GRANT CREATE ON SCHEMA sts_sch1 TO regress_stats_user1;
SET SESSION AUTHORIZATION regress_stats_user1;
CREATE STATISTICS sts_sch1.pass ON a, b FROM sts_sch1.tbl;
-- Tidy up -- Tidy up
DROP OPERATOR <<< (int, int); DROP OPERATOR <<< (int, int);
DROP FUNCTION op_leak(int, int); DROP FUNCTION op_leak(int, int);
@@ -970,4 +982,5 @@ DROP OPERATOR <<< (record, record);
DROP FUNCTION op_leak(record, record); DROP FUNCTION op_leak(record, record);
RESET SESSION AUTHORIZATION; RESET SESSION AUTHORIZATION;
DROP SCHEMA tststats CASCADE; DROP SCHEMA tststats CASCADE;
DROP SCHEMA sts_sch1 CASCADE;
DROP USER regress_stats_user1; DROP USER regress_stats_user1;