Skip to content

Backport 16 10 CVE fixes #1811

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
reshke wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Backport 16 10 CVE fixes #1811

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2ffa9fd
Fix security checks in selectivity estimation functions.
deanrasheed Aug 11, 2025
585be6e
Convert newlines to spaces in names written in v11+ pg_dump comments.
nmisch Aug 11, 2025
8c1cd5e
Restrict psql meta-commands in plain-text dumps.
nathan-bossart Aug 11, 2025
2086252
Adapt cloudberry regression suite for regression changes
reshke Jun 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions doc/src/sgml/ref/pg_dump.sgml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,18 @@ PostgreSQL documentation
light of the limitations listed below.
</para>

<warning>
<para>
Restoring a dump causes the destination to execute arbitrary code of the
source superusers' choice. Partial dumps and partial restores do not limit
that. If the source superusers are not trusted, the dumped SQL statements
must be inspected before restoring. Non-plain-text dumps can be inspected
by using <application>pg_restore</application>'s <option>--file</option>
option. Note that the client running the dump and restore need not trust
the source or destination superusers.
</para>
</warning>

</refsect1>

<refsect1 id="pg-dump-options">
Expand Down Expand Up @@ -1078,6 +1090,29 @@ PostgreSQL documentation
</listitem>
</varlistentry>

<varlistentry>
<term><option>--restrict-key=<replaceable class="parameter">restrict_key</replaceable></option></term>
<listitem>
<para>
Use the provided string as the <application>psql</application>
<command>\restrict</command> key in the dump output. This can only be
specified for plain-text dumps, i.e., when <option>--format</option> is
set to <literal>plain</literal> or the <option>--format</option> option
is omitted. If no restrict key is specified,
<application>pg_dump</application> will generate a random one as
needed. Keys may contain only alphanumeric characters.
</para>
<para>
This option is primarily intended for testing purposes and other
scenarios that require repeatable output (e.g., comparing dump files).
It is not recommended for general use, as a malicious server with
advance knowledge of the key may be able to inject arbitrary code that
will be executed on the machine that runs
<application>psql</application> with the dump output.
</para>
</listitem>
</varlistentry>

<varlistentry>
<term><option>--rows-per-insert=<replaceable class="parameter">nrows</replaceable></option></term>
<listitem>
Expand Down
30 changes: 30 additions & 0 deletions doc/src/sgml/ref/pg_dumpall.sgml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,16 @@ PostgreSQL documentation
linkend="libpq-pgpass"/> for more information.
</para>

<warning>
<para>
Restoring a dump causes the destination to execute arbitrary code of the
source superusers' choice. Partial dumps and partial restores do not limit
that. If the source superusers are not trusted, the dumped SQL statements
must be inspected before restoring. Note that the client running the dump
and restore need not trust the source or destination superusers.
</para>
</warning>

</refsect1>

<refsect1>
Expand Down Expand Up @@ -559,6 +569,26 @@ PostgreSQL documentation
</listitem>
</varlistentry>

<varlistentry>
<term><option>--restrict-key=<replaceable class="parameter">restrict_key</replaceable></option></term>
<listitem>
<para>
Use the provided string as the <application>psql</application>
<command>\restrict</command> key in the dump output. If no restrict
key is specified, <application>pg_dumpall</application> will generate a
random one as needed. Keys may contain only alphanumeric characters.
</para>
<para>
This option is primarily intended for testing purposes and other
scenarios that require repeatable output (e.g., comparing dump files).
It is not recommended for general use, as a malicious server with
advance knowledge of the key may be able to inject arbitrary code that
will be executed on the machine that runs
<application>psql</application> with the dump output.
</para>
</listitem>
</varlistentry>

<varlistentry>
<term><option>--rows-per-insert=<replaceable class="parameter">nrows</replaceable></option></term>
<listitem>
Expand Down
34 changes: 34 additions & 0 deletions doc/src/sgml/ref/pg_restore.sgml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,18 @@ PostgreSQL documentation
<application>pg_restore</application> will not be able to load the data
using <command>COPY</command> statements.
</para>

<warning>
<para>
Restoring a dump causes the destination to execute arbitrary code of the
source superusers' choice. Partial dumps and partial restores do not limit
that. If the source superusers are not trusted, the dumped SQL statements
must be inspected before restoring. Non-plain-text dumps can be inspected
by using <application>pg_restore</application>'s <option>--file</option>
option. Note that the client running the dump and restore need not trust
the source or destination superusers.
</para>
</warning>
</refsect1>

<refsect1 id="app-pgrestore-options">
Expand Down Expand Up @@ -675,6 +687,28 @@ PostgreSQL documentation
</listitem>
</varlistentry>

<varlistentry>
<term><option>--restrict-key=<replaceable class="parameter">restrict_key</replaceable></option></term>
<listitem>
<para>
Use the provided string as the <application>psql</application>
<command>\restrict</command> key in the dump output. This can only be
specified for SQL script output, i.e., when the <option>--file</option>
option is used. If no restrict key is specified,
<application>pg_restore</application> will generate a random one as
needed. Keys may contain only alphanumeric characters.
</para>
<para>
This option is primarily intended for testing purposes and other
scenarios that require repeatable output (e.g., comparing dump files).
It is not recommended for general use, as a malicious server with
advance knowledge of the key may be able to inject arbitrary code that
will be executed on the machine that runs
<application>psql</application> with the dump output.
</para>
</listitem>
</varlistentry>

<varlistentry>
<term><option>--section=<replaceable class="parameter">sectionname</replaceable></option></term>
<listitem>
Expand Down
8 changes: 8 additions & 0 deletions doc/src/sgml/ref/pgupgrade.sgml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,14 @@ PostgreSQL documentation
pg_upgrade supports upgrades from 9.2.X and later to the current
major release of <productname>PostgreSQL</productname>, including snapshot and beta releases.
</para>

<warning>
<para>
Upgrading a cluster causes the destination to execute arbitrary code of the
source superusers' choice. Ensure that the source superusers are trusted
before upgrading.
</para>
</warning>
</refsect1>

<refsect1>
Expand Down
36 changes: 36 additions & 0 deletions doc/src/sgml/ref/psql-ref.sgml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3355,6 +3355,24 @@ lo_import 152801
</varlistentry>


<varlistentry id="app-psql-meta-command-restrict">
<term><literal>\restrict <replaceable class="parameter">restrict_key</replaceable></literal></term>
<listitem>
<para>
Enter "restricted" mode with the provided key. In this mode, the only
allowed meta-command is <command>\unrestrict</command>, to exit
restricted mode. The key may contain only alphanumeric characters.
</para>
<para>
This command is primarily intended for use in plain-text dumps
generated by <application>pg_dump</application>,
<application>pg_dumpall</application>, and
<application>pg_restore</application>, but it may be useful elsewhere.
</para>
</listitem>
</varlistentry>


<varlistentry id="app-psql-meta-command-s">
<term><literal>\s [ <replaceable class="parameter">filename</replaceable> ]</literal></term>
<listitem>
Expand Down Expand Up @@ -3529,6 +3547,24 @@ testdb=&gt; <userinput>\setenv LESS -imx4F</userinput>
</varlistentry>


<varlistentry id="app-psql-meta-command-unrestrict">
<term><literal>\unrestrict <replaceable class="parameter">restrict_key</replaceable></literal></term>
<listitem>
<para>
Exit "restricted" mode (i.e., where all other meta-commands are
blocked), provided the specified key matches the one given to
<command>\restrict</command> when restricted mode was entered.
</para>
<para>
This command is primarily intended for use in plain-text dumps
generated by <application>pg_dump</application>,
<application>pg_dumpall</application>, and
<application>pg_restore</application>, but it may be useful elsewhere.
</para>
</listitem>
</varlistentry>


<varlistentry id="app-psql-meta-command-unset">
<term><literal>\unset <replaceable class="parameter">name</replaceable></literal></term>

Expand Down
3 changes: 1 addition & 2 deletions src/backend/executor/execMain.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,7 +180,6 @@ static void ExecutePlan(QueryDesc *queryDesc,
ScanDirection direction,
DestReceiver *dest,
bool execute_once);
static bool ExecCheckOneRelPerms(RTEPermissionInfo *perminfo);
static bool ExecCheckPermissionsModified(Oid relOid, Oid userid,
Bitmapset *modifiedCols,
AclMode requiredPerms);
Expand Down Expand Up @@ -1523,7 +1522,7 @@ ExecCheckPermissions(List *rangeTable, List *rteperminfos,
* ExecCheckOneRelPerms
* Check access permissions for a single relation.
*/
static bool
bool
ExecCheckOneRelPerms(RTEPermissionInfo *perminfo)
{
AclMode requiredPerms;
Expand Down
33 changes: 33 additions & 0 deletions src/backend/optimizer/plan/planner.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,7 @@
#include "partitioning/partdesc.h"
#include "rewrite/rewriteManip.h"
#include "storage/dsm_impl.h"
#include "utils/acl.h"
#include "utils/lsyscache.h"
#include "utils/rel.h"
#include "utils/selfuncs.h"
Expand Down Expand Up @@ -1144,6 +1145,38 @@ subquery_planner(PlannerGlobal *glob, Query *parse,
bms_make_singleton(parse->resultRelation);
}

/*
* This would be a convenient time to check access permissions for all
* relations mentioned in the query, since it would be better to fail now,
* before doing any detailed planning. However, for historical reasons,
* we leave this to be done at executor startup.
*
* Note, however, that we do need to check access permissions for any view
* relations mentioned in the query, in order to prevent information being
* leaked by selectivity estimation functions, which only check view owner
* permissions on underlying tables (see all_rows_selectable() and its
* callers). This is a little ugly, because it means that access
* permissions for views will be checked twice, which is another reason
* why it would be better to do all the ACL checks here.
*/
foreach(l, parse->rtable)
{
RangeTblEntry *rte = lfirst_node(RangeTblEntry, l);

if (rte->perminfoindex != 0 &&
rte->relkind == RELKIND_VIEW)
{
RTEPermissionInfo *perminfo;
bool result;

perminfo = getRTEPermissionInfo(parse->rteperminfos, rte);
result = ExecCheckOneRelPerms(perminfo);
if (!result)
aclcheck_error(ACLCHECK_NO_PRIV, OBJECT_VIEW,
get_rel_name(perminfo->relid));
}
}

/*
* Preprocess RowMark information. We need to do this after subquery
* pullup, so that all base relations are present.
Expand Down
Loading
Loading