database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-02 09:02:37 +03:00
Code Activity

Require the schema qualification in pg_temp.type_name(arg).

Browse Source 
Commit aa27977fe2 introduced this
restriction for pg_temp.function_name(arg); do likewise for types
created in temporary schemas.  Programs that this breaks should add
"pg_temp." schema qualification or switch to arg::type_name syntax.
Back-patch to 9.4 (all supported versions).

Reviewed by Tom Lane.  Reported by Tom Lane.

Security: CVE-2019-10208
This commit is contained in:
Noah Misch
2019-08-05 07:48:41 -07:00
parent a76cfba663
commit ffa2d37e5f
9 changed files with 83 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/backend/utils/adt/ruleutils.c
View File

@ -9475,6 +9475,14 @@ get_coercion_expr(Node *arg, deparse_context *context,
if (!PRETTY_PAREN(context))
appendStringInfoChar(buf, ')');
}
/*
* Never emit resulttype(arg) functional notation. A pg_proc entry could
* take precedence, and a resulttype in pg_temp would require schema
* qualification that format_type_with_typemod() would usually omit. We've
* standardized on arg::resulttype, but CAST(arg AS resulttype) notation
* would work fine.
*/
appendStringInfo(buf, "::%s",
format_type_with_typemod(resulttype, resulttypmod));
}