database/postgres
database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-05-29 16:21:20 +03:00
Code

oauth: Classify oauth_client_secret as a password

Browse Source 
Tell UIs to hide the value of oauth_client_secret, like the other
passwords. Due to the previous commit, this does not affect postgres_fdw
and dblink, but add a comment to try to warn others of the hazard in the
future.

Reported-by: Noah Misch <noah@leadboat.com>
Reviewed-by: Noah Misch <noah@leadboat.com>
Discussion: https://postgr.es/m/20250415191435.55.nmisch%40google.com
This commit is contained in:
Jacob Champion 2025-04-29 13:08:55 -07:00
parent d2e7d2a09d
commit e974f1c216
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/interfaces/libpq/fe-connect.c
View File

@ -158,6 +158,12 @@ static int ldapServiceLookup(const char *purl, PQconninfoOption *options,
* "*" Password field - hide value
* "D" Debug option - don't show by default
*
* NB: Server-side clients -- dblink, postgres_fdw, libpqrcv -- use dispchar to
* determine which options to expose to end users, and how. Changing dispchar
* has compatibility and security implications for those clients. For example,
* postgres_fdw will attach a "*" option to USER MAPPING instead of the default
* SERVER, and it disallows setting "D" options entirely.
*
* PQconninfoOptions[] is a constant static array that we use to initialize
* a dynamically allocated working copy. All the "val" fields in
* PQconninfoOptions[] *must* be NULL. In a working copy, non-null "val"
@ -394,7 +400,7 @@ static const internalPQconninfoOption PQconninfoOptions[] = {
offsetof(struct pg_conn, oauth_client_id)},
{"oauth_client_secret", NULL, NULL, NULL,
"OAuth-Client-Secret", "", 40,
"OAuth-Client-Secret", "*", 40,
offsetof(struct pg_conn, oauth_client_secret)},
{"oauth_scope", NULL, NULL, NULL,