database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-10-23 13:29:09 +03:00
Code Activity

Check for USAGE privilege on the subtype in CREATE TYPE AS RANGE.

Browse Source 
This omission allowed roles without USAGE on a type to create range
types that depend on it, which could prevent the owner from
changing the type later.

Reported-by: Jingzhou Fu <fuboat@outlook.com>
Author: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Noah Misch <noah@leadboat.com>
Reviewed-by: Robert Haas <robertmhaas@gmail.com>
Security: CVE-2026-6470
Backpatch-through: 14
This commit is contained in:
Nathan Bossart
2026-08-10 06:38:30 -07:00
committed by Noah Misch
parent 74916136fc
commit 97e2774028
4 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
doc/src/sgml/ref/create_type.sgml
View File

@@ -186,6 +186,11 @@ CREATE TYPE <replaceable class="parameter">name</replaceable>
type name. Otherwise, the multirange type name is formed by appending a
<literal>_multirange</literal> suffix to the range type name.
</para>
<para>
To be able to create a range type, you must have <literal>USAGE</literal>
privilege on the subtype.
</para>
</refsect2>
<refsect2>

4
src/backend/commands/typecmds.c
View File

@@ -1470,6 +1470,10 @@ DefineRange(ParseState *pstate, CreateRangeStmt *stmt)
errmsg("range subtype cannot be %s",
format_type_be(rangeSubtype))));
aclresult = pg_type_aclcheck(rangeSubtype, GetUserId(), ACL_USAGE);
if (aclresult != ACLCHECK_OK)
aclcheck_error_type(aclresult, rangeSubtype);
/* Identify subopclass */
rangeSubOpclass = findRangeSubOpclass(rangeSubOpclassName, rangeSubtype);

15
src/test/regress/expected/rangetypes.out
View File

@@ -1480,6 +1480,21 @@ ERROR: range lower bound must be less than or equal to range upper bound
LINE 1: select '[2010-01-01 01:00:00 -08, 2010-01-01 02:00:00 -05)':...
^
set timezone to default;
-- CREATE TYPE AS RANGE checks for USAGE on subtype
CREATE ROLE regress_subtype;
CREATE TYPE mytype AS (a INT, b INT);
REVOKE USAGE ON TYPE mytype FROM PUBLIC;
SET ROLE regress_subtype;
CREATE TYPE myrange AS RANGE (subtype = mytype);
ERROR: permission denied for type mytype
RESET ROLE;
GRANT USAGE ON TYPE mytype TO regress_subtype;
SET ROLE regress_subtype;
CREATE TYPE myrange AS RANGE (subtype = mytype);
RESET ROLE;
DROP TYPE mytype CASCADE;
NOTICE: drop cascades to type myrange
DROP ROLE regress_subtype;
--
-- Test user-defined range of floats
-- (type float8range was already made in test_setup.sql)

14
src/test/regress/sql/rangetypes.sql
View File

@@ -421,6 +421,20 @@ select '[2010-01-01 01:00:00 -05, 2010-01-01 02:00:00 -08)'::tstzrange;
select '[2010-01-01 01:00:00 -08, 2010-01-01 02:00:00 -05)'::tstzrange;
set timezone to default;
-- CREATE TYPE AS RANGE checks for USAGE on subtype
CREATE ROLE regress_subtype;
CREATE TYPE mytype AS (a INT, b INT);
REVOKE USAGE ON TYPE mytype FROM PUBLIC;
SET ROLE regress_subtype;
CREATE TYPE myrange AS RANGE (subtype = mytype);
RESET ROLE;
GRANT USAGE ON TYPE mytype TO regress_subtype;
SET ROLE regress_subtype;
CREATE TYPE myrange AS RANGE (subtype = mytype);
RESET ROLE;
DROP TYPE mytype CASCADE;
DROP ROLE regress_subtype;
--
-- Test user-defined range of floats
-- (type float8range was already made in test_setup.sql)