10000 Remove PushOverrideSearchPath() and PopOverrideSearchPath(). · postgres/postgres@7c5c4e1 · GitHub
[go: up one dir, main page]
Skip to content

Commit 7c5c4e1

Browse files
nmischnmisch
committed
Remove PushOverrideSearchPath() and PopOverrideSearchPath().
Since commit 681d9e4, they have no in-tree calls. Any new calls would introduce security vulnerabilities like the one fixed in that commit. Alexander Lakhin, reviewed by Aleksander Alekseev. Discussion: https://postgr.es/m/8ffb4650-52c4-6a81-38fc-8f99be981130@gmail.com
1 parent c9af054 commit 7c5c4e1

File tree

4 files changed

+6
-235
lines changed

4 files changed

+6
-235
lines changed

‎src/backend/catalog/namespace.c

Lines changed: 6 additions & 227 deletions
Original file line numberDiff line numberDiff line change
@@ -67,9 +67,7 @@
6767
* may be included:
6868
*
6969
* 1. If a TEMP table namespace has been initialized in this session, it
70-
* is implicitly searched first. (The only time this doesn't happen is
71-
* when we are obeying an override search path spec that says not to use the
72-
* temp namespace, or the temp namespace is included in the explicit list.)
70+
* is implicitly searched first.
7371
*
7472
* 2. The system catalog namespace is always searched. If the system
7573
* namespace is present in the explicit path then it will be searched in
@@ -108,19 +106,14 @@
108106
* namespace (if it exists), preceded by the user's personal namespace
109107
* (if one exists).
110108
*
111-
* We support a stack of "override" search path settings for use within
112-
* specific sections of backend code. namespace_search_path is ignored
113-
* whenever the override stack is nonempty. activeSearchPath is always
114-
* the actually active path; it points either to the search list of the
115-
* topmost stack entry, or to baseSearchPath which is the list derived
116-
* from namespace_search_path.
109+
* activeSearchPath is always the actually active path; it points to
110+
* to baseSearchPath which is the list derived from namespace_search_path.
117111
*
118112
* If baseSearchPathValid is false, then baseSearchPath (and other
119113
* derived variables) need to be recomputed from namespace_search_path.
120114
* We mark it invalid upon an assignment to namespace_search_path or receipt
121115
* of a syscache invalidation event for pg_namespace. The recomputation
122-
* is done during the next non-overridden lookup attempt. Note that an
123-
* override spec is never subject to recomputation.
116+
* is done during the next lookup attempt.
124117
*
125118
* Any namespaces mentioned in namespace_search_path that are not readable
126119
* by the current user ID are simply left out of baseSearchPath; so
@@ -161,17 +154,6 @@ static Oid namespaceUser = InvalidOid;
161154
/* The above four values are valid only if baseSearchPathValid */
162155
static bool baseSearchPathValid = true;
163156

164-
/* Override requests are remembered in a stack of OverrideStackEntry structs */
165-
166-
typedef struct
167-
{
168-
List *searchPath; /* the desired search path */
169-
Oid creationNamespace; /* the desired creation namespace */
170-
int nestLevel; /* subtransaction nesting level */
171-
} OverrideStackEntry;
172-
173-
static List *overrideStack = NIL;
174-
175157
/*
176158
* myTempNamespace is InvalidOid until and unless a TEMP namespace is set up
177159
* in a particular backend session (this happens when a CREATE TEMP TABLE
@@ -3392,8 +3374,7 @@ SetTempNamespaceState(Oid tempNamespaceId, Oid tempToastNamespaceId)
33923374

33933375

33943376
/*
3395-
* GetOverrideSearchPath - fetch current search path definition in form
3396-
* used by PushOverrideSearchPath.
3377+
* GetOverrideSearchPath - fetch current search path definition.
33973378
*
33983379
* The result structure is allocated in the specified memory context
33993380
* (which might or might not be equal to CurrentMemoryContext); but any
@@ -3512,132 +3493,6 @@ OverrideSearchPathMatchesCurrent(OverrideSearchPath *path)
35123493
return true;
35133494
}
35143495

3515-
/*
3516-
* PushOverrideSearchPath - temporarily override the search path
3517-
*
3518-
* Do not use this function; almost any usage introduces a security
3519-
* vulnerability. It exists for the benefit of legacy code running in
3520-
* non-security-sensitive environments.
3521-
*
3522-
* We allow nested overrides, hence the push/pop terminology. The GUC
3523-
* search_path variable is ignored while an override is active.
3524-
*
3525-
* It's possible that newpath->useTemp is set but there is no longer any
3526-
* active temp namespace, if the path was saved during a transaction that
3527-
* created a temp namespace and was later rolled back. In that case we just
3528-
* ignore useTemp. A plausible alternative would be to create a new temp
3529-
* namespace, but for existing callers that's not necessary because an empty
3530-
* temp namespace wouldn't affect their results anyway.
3531-
*
3532-
* It's also worth noting that other schemas listed in newpath might not
3533-
* exist anymore either. We don't worry about this because OIDs that match
3534-
* no existing namespace will simply not produce any hits during searches.
3535-
*/
3536-
void
3537-
PushOverrideSearchPath(OverrideSearchPath *newpath)
3538-
{
3539-
OverrideStackEntry *entry;
3540-
List *oidlist;
3541-
Oid firstNS;
3542-
MemoryContext oldcxt;
3543-
3544-
/*
3545-
* Copy the list for safekeeping, and insert implicitly-searched
3546-
* namespaces as needed. This code should track recomputeNamespacePath.
3547-
*/
3548-
oldcxt = MemoryContextSwitchTo(TopMemoryContext);
3549-
3550-
oidlist = list_copy(newpath->schemas);
3551-
3552-
/*
3553-
* Remember the first member of the explicit list.
3554-
*/
3555-
if (oidlist == NIL)
3556-
firstNS = InvalidOid;
3557-
else
3558-
firstNS = linitial_oid(oidlist);
3559-
3560-
/*
3561-
* Add any implicitly-searched namespaces to the list. Note these go on
3562-
* the front, not the back; also notice that we do not check USAGE
3563-
* permissions for these.
3564-
*/
3565-
if (newpath->addCatalog)
3566-
oidlist = lcons_oid(PG_CATALOG_NAMESPACE, oidlist);
3567-
3568-
if (newpath->addTemp && OidIsValid(myTempNamespace))
3569-
oidlist = lcons_oid(myTempNamespace, oidlist);
3570-
3571-
/*
3572-
* Build the new stack entry, then insert it at the head of the list.
3573-
*/
3574-
entry = (OverrideStackEntry *) palloc(sizeof(OverrideStackEntry));
3575-
entry->searchPath = oidlist;
3576-
entry->creationNamespace = firstNS;
3577-
entry->nestLevel = GetCurrentTransactionNestLevel();
3578-
3579-
overrideStack = lcons(entry, overrideStack);
3580-
3581-
/* And make it active. */
3582-
activeSearchPath = entry->searchPath;
3583-
activeCreationNamespace = entry->creationNamespace;
3584-
activeTempCreationPending = false; /* XXX is this OK? */
3585-
3586-
/*
3587-
* We always increment activePathGeneration when pushing/popping an
3588-
* override path. In current usage, these actions always change the
3589-
* effective path state, so there's no value in checking to see if it
3590-
* didn't change.
3591-
*/
3592-
activePathGeneration++;
3593-
3594-
MemoryContextSwitchTo(oldcxt);
3595-
}
3596-
3597-
/*
3598-
* PopOverrideSearchPath - undo a previous PushOverrideSearchPath
3599-
*
3600-
* Any push during a (sub)transaction will be popped automatically at abort.
3601-
* But it's caller error if a push isn't popped in normal control flow.
3602-
*/
3603-
void
3604-
PopOverrideSearchPath(void)
3605-
{
3606-
OverrideStackEntry *entry;
3607-
3608-
/* Sanity checks. */
3609-
if (overrideStack == NIL)
3610-
elog(ERROR, "bogus PopOverrideSearchPath call");
3611-
entry = (OverrideStackEntry *) linitial(overrideStack);
3612-
if (entry->nestLevel != GetCurrentTransactionNestLevel())
3613-
elog(ERROR, "bogus PopOverrideSearchPath call");
3614-
3615-
/* Pop the stack and free storage. */
3616-
overrideStack = list_delete_first(overrideStack);
3617-
list_free(entry->searchPath);
3618-
pfree(entry);
3619-
3620-
/* Activate the next level down. */
3621-
if (overrideStack)
3622-
{
3623-
entry = (OverrideStackEntry *) linitial(overrideStack);
3624-
activeSearchPath = entry->searchPath;
3625-
activeCreationNamespace = entry->creationNamespace;
3626-
activeTempCreationPending = false; /* XXX is this OK? */
3627-
}
3628-
else
3629-
{
3630-
/* If not baseSearchPathValid, this is useless but harmless */
3631-
activeSearchPath = baseSearchPath;
3632-
activeCreationNamespace = baseCreationNamespace;
3633-
activeTempCreationPending = baseTempCreationPending;
3634-
}
3635-
3636-
/* As above, the generation always increments. */
3637-
activePathGeneration++;
3638-
}
3639-
3640-
36413496
/*
36423497
* get_collation_oid - find a collation by possibly qualified name
36433498
*
@@ -3794,10 +3649,6 @@ recomputeNamespacePath(void)
37943649
bool pathChanged;
37953650
MemoryContext oldcxt;
37963651

3797-
/* Do nothing if an override search spec is active. */
3798-
if (overrideStack)
3799-
return;
3800-
38013652
/* Do nothing if path is already valid. */
38023653
if (baseSearchPathValid && namespaceUser == roleid)
38033654
return;
@@ -3936,10 +3787,7 @@ recomputeNamespacePath(void)
39363787

39373788
/*
39383789
* Bump the generation only if something actually changed. (Notice that
3939-
* what we compared to was the old state of the base path variables; so
3940-
* this does not deal with the situation where we have just popped an
3941-
* override path and restored the prior state of the base path. Instead
3942-
* we rely on the override-popping logic to have bumped the generation.)
3790+
* what we compared to was the old state of the base path variables.)
39433791
*/
39443792
if (pathChanged)
39453793
activePathGeneration++;
@@ -4142,29 +3990,6 @@ AtEOXact_Namespace(bool isCommit, bool parallel)
41423990
myTempNamespaceSubID = InvalidSubTransactionId;
41433991
}
41443992

4145-
/*
4146-
* Clean up if someone failed to do PopOverrideSearchPath
4147-
*/
4148-
if (overrideStack)
4149-
{
4150-
if (isCommit)
4151-
elog(WARNING, "leaked override search path");
4152-
while (overrideStack)
4153-
{
4154-
OverrideStackEntry *entry;
4155-
4156-
entry = (OverrideStackEntry *) linitial(overrideStack);
4157-
overrideStack = list_delete_first(overrideStack);
4158-
list_free(entry->searchPath);
4159-
pfree(entry);
4160-
}
4161-
/* If not baseSearchPathValid, this is useless but harmless */
4162-
activeSearchPath = baseSearchPath;
4163-
activeCreationNamespace = baseCreationNamespace;
4164-
activeTempCreationPending = baseTempCreationPending;
4165-
/* Always bump generation --- see note in recomputeNamespacePath */
4166-
activePathGeneration++;
4167-
}
41683993
}
41693994

41703995
/*
@@ -4179,7 +4004,6 @@ void
41794004
AtEOSubXact_Namespace(bool isCommit, SubTransactionId mySubid,
41804005
SubTransactionId parentSubid)
41814006
{
4182-
OverrideStackEntry *entry;
41834007

41844008
if (myTempNamespaceSubID == mySubid)
41854009
{
@@ -4205,51 +4029,6 @@ AtEOSubXact_Namespace(bool isCommit, SubTransactionId mySubid,
42054029
MyProc->tempNamespaceId = InvalidOid;
42064030
}
42074031
}
4208-
4209-
/*
4210-
* Clean up if someone failed to do PopOverrideSearchPath
4211-
*/
4212-
while (overrideStack)
4213-
{
4214-
entry = (OverrideStackEntry *) linitial(overrideStack);
4215-
if (entry->nestLevel < GetCurrentTransactionNestLevel())
4216-
break;
4217-
if (isCommit)
4218-
elog(WARNING, "leaked override search path");
4219-
overrideStack = list_delete_first(overrideStack);
4220-
list_free(entry->searchPath);
4221-
pfree(entry);
4222-
/* Always bump generation --- see note in recomputeNamespacePath */
4223-
activePathGeneration++;
4224-
}
4225-
4226-
/* Activate the next level down. */
4227-
if (overrideStack)
4228-
{
4229-
entry = (OverrideStackEntry *) linitial(overrideStack);
4230-
activeSearchPath = entry->searchPath;
4231-
activeCreationNamespace = entry->creationNamespace;
4232-
activeTempCreationPending = false; /* XXX is this OK? */
4233-
4234-
/*
4235-
* It's probably unnecessary to bump generation here, but this should
4236-
* not be a performance-critical case, so better to be over-cautious.
4237-
*/
4238-
activePathGeneration++;
4239-
}
4240-
else
4241-
{
4242-
/* If not baseSearchPathValid, this is useless but harmless */
4243-
activeSearchPath = baseSearchPath;
4244-
activeCreationNamespace = baseCreationNamespace;
4245-
activeTempCreationPending = baseTempCreationPending;
4246-
4247-
/*
4248-
* If we popped an override stack entry, then we already bumped the
4249-
* generation above. If we did not, then the above assignments did
4250-
* nothing and we need not bump the generation.
4251-
*/
4252-
}
42534032
}
42544033

42554034
/*

‎src/backend/commands/extension.c

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -967,11 +967,6 @@ execute_extension_script(Oid extensionOid, ExtensionControlFile *control,
967967
* searched anyway. (Listing pg_catalog explicitly in a non-first
968968
* position would be bad for security.) Finally add pg_temp to ensure
969969
* that temp objects can't take precedence over others.
970-
*
971-
* Note: it might look tempting to use PushOverrideSearchPath for this,
972-
* but we cannot do that. We have to actually set the search_path GUC in
973-
* case the extension script examines or changes it. In any case, the
974-
* GUC_ACTION_SAVE method is just as convenient.
975970
*/
976971
initStringInfo(&pathbuf);
977972
appendStringInfoString(&pathbuf, quote_identifier(schemaName));

‎src/include/catalog/namespace.h

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -167,8 +167,6 @@ extern void ResetTempTableNamespace(void);
167167
extern OverrideSearchPath *GetOverrideSearchPath(MemoryContext context);
168168
extern OverrideSearchPath *CopyOverrideSearchPath(OverrideSearchPath *path);
169169
extern bool OverrideSearchPathMatchesCurrent(OverrideSearchPath *path);
170-
extern void PushOverrideSearchPath(OverrideSearchPath *newpath);
171-
extern void PopOverrideSearchPath(void);
172170

173171
extern Oid get_collation_oid(List *collname, bool missing_ok);
174172
extern Oid get_conversion_oid(List *conname, bool missing_ok);

‎src/tools/pgindent/typedefs.list

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1687,7 +1687,6 @@ OutputPluginCallbacks
16871687
OutputPluginOptions
16881688
OutputPluginOutputType
16891689
OverrideSearchPath
1690-
OverrideStackEntry
16911690
OverridingKind
16921691
PACE_HEADER
16931692
PACL

0 commit comments

Comments
 (0)
0