database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-15 19:21:59 +03:00
Code Activity

Handle append_rel_list in expand_security_qual

Browse Source 
During expand_security_quals, we take the security barrier quals on an
RTE and create a subquery which evaluates the quals.  During this, we
have to replace any variables in the outer query which refer to the
original RTE with references to the columns from the subquery.

We need to also perform that replacement for any Vars in the
append_rel_list.

Only backpatching to 9.5 as we only go through this process in 9.4 for
auto-updatable security barrier views, which UNION ALL queries aren't.

Discovered by Haribabu Kommi

Patch by Dean Rasheed
This commit is contained in:
Stephen Frost
2015-10-09 10:49:02 -04:00
parent 94f5246ce1
commit b7aac36245
3 changed files with 34 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/backend/optimizer/prep/prepsecurity.c
View File

@ -56,6 +56,12 @@ static bool security_barrier_replace_vars_walker(Node *node,
* the others, providing protection against malicious user-defined security
* barriers. The first security barrier qual in the list will be used in the
* innermost subquery.
*
* In practice, the only RTEs that will have security barrier quals are those
* that refer to tables with row-level security, or which are the target
* relation of an update to an auto-updatable security barrier view. RTEs
* that read from a security barrier view will have already been expanded by
* the rewriter.
*/
void
expand_security_quals(PlannerInfo *root, List *tlist)
@ -263,7 +269,8 @@ expand_security_qual(PlannerInfo *root, List *tlist, int rt_index,
* Replace any variables in the outer query that refer to the
* original relation RTE with references to columns that we will
* expose in the new subquery, building the subquery's targetlist
* as we go.
* as we go. Also replace any references in the translated_vars
* lists of any appendrels.
*/
context.rt_index = rt_index;
context.sublevels_up = 0;
@ -274,6 +281,8 @@ expand_security_qual(PlannerInfo *root, List *tlist, int rt_index,
security_barrier_replace_vars((Node *) parse, &context);
security_barrier_replace_vars((Node *) tlist, &context);
security_barrier_replace_vars((Node *) root->append_rel_list,
&context);
heap_close(context.rel, NoLock);