database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-10-23 13:29:09 +03:00
Code Activity

Fix postmaster crash on whitespace-only oauth_validator_libraries

Browse Source 
The check_oauth_validator check for an empty validator list didn't test
for a string with only whitespace, which would cause the postmaster to
crash.  Instead of testing for the empty string cases, pass the config
value to SplitDirectoriesString unconditionally.  If an empty list is
returned then the input string was empty.  Since pstrdup cannot handle
NULL, assert that the string ie set.  While users cannot set the string
to NULL, it is initialized to NULL so guard against programmer error.

Check the parsed list instead.  Assert that the GUC string is non-NULL
before pstrdup(); users cannot set it to NULL, but the C variable is
initialized that way.

This also adds a TAP test that reloads a whitespace-only setting after
pg_hba_file_rules and waits until the existing backend sees the restored
GUC.

Author: Grigorev Jurij <ju.grigorev@ftdata.ru>
Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com>
Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
Discussion: https://postgr.es/m/04fa84f6ebbe400f940e179ebe1070e9@localhost.localdomain
Backpatch-through: 18
This commit is contained in:
Daniel Gustafsson
2026-09-17 14:52:30 +02:00
parent a62ff0829d
commit bca67e5a33
2 changed files with 32 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
src/backend/libpq/auth-oauth.c
View File

@@ -863,20 +863,8 @@ check_oauth_validator(HbaLine *hbaline, int elevel, char **err_msg)
*err_msg = NULL;
if (oauth_validator_libraries_string[0] == '\0')
{
ereport(elevel,
errcode(ERRCODE_CONFIG_FILE_ERROR),
errmsg("parameter \"%s\" must be set for authentication method \"%s\"",
"oauth_validator_libraries", "oauth"),
errcontext("line %d of configuration file \"%s\"",
line_num, file_name));
*err_msg = psprintf("parameter \"%s\" must be set for authentication method \"%s\"",
"oauth_validator_libraries", "oauth");
return false;
}
/* SplitDirectoriesString needs a modifiable copy */
Assert(oauth_validator_libraries_string != NULL);
rawstring = pstrdup(oauth_validator_libraries_string);
if (!SplitDirectoriesString(rawstring, ',', &elemlist))
@@ -891,6 +879,19 @@ check_oauth_validator(HbaLine *hbaline, int elevel, char **err_msg)
goto done;
}
if (elemlist == NIL)
{
ereport(elevel,
errcode(ERRCODE_CONFIG_FILE_ERROR),
errmsg("parameter \"%s\" must be set for authentication method \"%s\"",
"oauth_validator_libraries", "oauth"),
errcontext("line %d of configuration file \"%s\"",
line_num, file_name));
*err_msg = psprintf("parameter \"%s\" must be set for authentication method \"%s\"",
"oauth_validator_libraries", "oauth");
goto done;
}
if (!hbaline->oauth_validator)
{
if (elemlist->length == 1)

18
src/test/modules/oauth_validator/t/001_server.pl
View File

@@ -134,6 +134,24 @@ is( $contents,
3|oauth|\{issuer=$issuer/param,"scope=openid postgres",validator=validator\}},
"pg_hba_file_rules recreates OAuth HBA settings");
# An all-whitespace library list parses as an empty list. Reject it without
# crashing the postmaster during HBA reload.
$node->append_conf('postgresql.conf', "oauth_validator_libraries = ' '");
$node->reload;
$log_start = $node->wait_for_log(
qr/parameter "oauth_validator_libraries" must be set for authentication/,
$log_start);
$bgconn->query_safe('SELECT 1');
$node->append_conf('postgresql.conf',
"oauth_validator_libraries = 'validator'");
$node->reload;
$log_start = $node->wait_for_log(
qr/parameter "oauth_validator_libraries" changed to "validator"/,
$log_start);
is($bgconn->query_safe('SHOW oauth_validator_libraries'),
'validator', 'oauth_validator_libraries restored');
{
# Make sure PGOAUTHDEBUG=UNSAFE doesn't disable certificate verification.
local $ENV{PGOAUTHDEBUG} = "UNSAFE";