database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-08-24 09:27:52 +03:00
Code Activity

Handle RLS dependencies in inlined set-returning functions properly.

Browse Source 
If an SRF in the FROM clause references a table having row-level
security policies, and we inline that SRF into the calling query,
we neglected to mark the plan as potentially dependent on which
role is executing it.  This could lead to later executions in the
same session returning or hiding rows that should have been hidden
or returned instead.

Our thanks to Wolfgang Walther for reporting this problem.

Stephen Frost and Tom Lane

Security: CVE-2023-2455
This commit is contained in:
Tom Lane
2023-05-08 10:12:44 -04:00
parent 681d9e4621
commit ca73753b09
3 changed files with 54 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/backend/optimizer/util/clauses.c
View File

@@ -5205,6 +5205,13 @@ inline_set_returning_function(PlannerInfo *root, RangeTblEntry *rte)
*/
record_plan_function_dependency(root, func_oid);
/*
* We must also notice if the inserted query adds a dependency on the
* calling role due to RLS quals.
*/
if (querytree->hasRowSecurity)
root->glob->dependsOnRole = true;
return querytree;
/* Here if func is not inlinable: release temp memory and return NULL */