From f9729b5078dca08f5c873ca063f0449e8bb3f256 Mon Sep 17 00:00:00 2001 From: Nathan Bossart Date: Mon, 10 Aug 2026 06:37:49 -0700 Subject: [PATCH] Obstruct EXTRACT() field name deparse injection. The parser accepts any string as an EXTRACT() field name, but deparsing does not quote and escape it accordingly. To fix, quote and escape the field name during deparsing as needed. It might be a good idea to validate the field name during parsing and deparsing, too, but that is left as a future exercise. Reported-by: Ben Morris in collaboration with Claude and Anthropic Research Author: Nathan Bossart Reviewed-by: Tom Lane Reviewed-by: Etsuro Fujita Security: CVE-2026-15741 Backpatch-through: 14 --- src/backend/utils/adt/ruleutils.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/backend/utils/adt/ruleutils.c b/src/backend/utils/adt/ruleutils.c index 1d41c06201b..e95dd1b11eb 100644 --- a/src/backend/utils/adt/ruleutils.c +++ b/src/backend/utils/adt/ruleutils.c @@ -11812,7 +11812,7 @@ get_func_sql_syntax(FuncExpr *expr, deparse_context *context) Assert(IsA(con, Const) && con->consttype == TEXTOID && !con->constisnull); - appendStringInfoString(buf, TextDatumGetCString(con->constvalue)); + appendStringInfoString(buf, quote_identifier(TextDatumGetCString(con->constvalue))); } appendStringInfoString(buf, " FROM "); get_rule_expr((Node *) lsecond(expr->args), context, false); @@ -11832,6 +11832,7 @@ get_func_sql_syntax(FuncExpr *expr, deparse_context *context) Assert(IsA(con, Const) && con->consttype == TEXTOID && !con->constisnull); + /* NB: safe because no allowed words need quoted/escaped */ appendStringInfo(buf, " %s", TextDatumGetCString(con->constvalue)); }