database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-06-26 12:21:12 +03:00
Code Activity

Obstruct shell, SQL, and conninfo injection via database and role names.

Browse Source 
Due to simplistic quoting and confusion of database names with conninfo
strings, roles with the CREATEDB or CREATEROLE option could escalate to
superuser privileges when a superuser next ran certain maintenance
commands.  The new coding rule for PQconnectdbParams() calls, documented
at conninfo_array_parse(), is to pass expand_dbname=true and wrap
literal database names in a trivial connection string.  Escape
zero-length values in appendConnStrVal().  Back-patch to 9.1 (all
supported versions).

Nathan Bossart, Michael Paquier, and Noah Misch.  Reviewed by Peter
Eisentraut.  Reported by Nathan Bossart.

Security: CVE-2016-5424
This commit is contained in:
Noah Misch
2016-08-08 10:07:46 -04:00
parent d2dd5df514
commit a2385cac13
21 changed files with 572 additions and 193 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/interfaces/libpq/fe-connect.c
View File

@ -4377,10 +4377,15 @@ conninfo_parse(const char *conninfo, PQExpBuffer errorMessage,
* Defaults are supplied (from a service file, environment variables, etc)
* for unspecified options, but only if use_defaults is TRUE.
*
* If expand_dbname is non-zero, and the value passed for keyword "dbname"
* contains an "=", assume it is a conninfo string and process it,
* overriding any previously processed conflicting keywords. Subsequent
* keywords will take precedence, however.
* If expand_dbname is non-zero, and the value passed for the first occurrence
* of "dbname" keyword contains an "=", assume it is a conninfo string and
* process it, overriding any previously processed conflicting
* keywords. Subsequent keywords will take precedence, however. In-tree
* programs generally specify expand_dbname=true, so command-line arguments
* naming a database can use a connection string. Some code acquires
* arbitrary database names from known-literal sources like PQdb(),
* PQconninfoParse() and pg_database.datname. When connecting to such a
* database, in-tree code first wraps the name in a connection string.
*/
static PQconninfoOption *
conninfo_array_parse(const char **keywords, const char **values,