10000 Use @extschema:name@ notation in contrib transform modules. · postgres/postgres@bebe904 · GitHub
[go: up one dir, main page]
Skip to content

Commit bebe904

Browse files
tglsfdctglsfdc
committed
Use @extschema:name@ notation in contrib transform modules.
Harden hstore_plperl, hstore_plpython, and ltree_plpython against search-path-based attacks by using @extschema:name@ notation to refer to the underlying hstore or ltree data type. This allows removal of the previous documentation warning suggesting that they must be installed in the same schema as the underlying data type. In passing, also improve a para in extend.sgml to suggest using @extschema:name@ for such purposes. Discussion: https://postgr.es/m/692480.1736021695@sss.pgh.pa.us
1 parent ebd8fc7 commit bebe904

File tree

7 files changed

+13
-35
lines changed

7 files changed

+13
-35
lines changed

‎contrib/hstore_plperl/hstore_plperl--1.0.sql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,11 @@ CREATE FUNCTION hstore_to_plperl(val internal) RETURNS internal
77
LANGUAGE C STRICT IMMUTABLE
88
AS 'MODULE_PATHNAME';
99

10-
CREATE FUNCTION plperl_to_hstore(val internal) RETURNS hstore
10+
CREATE FUNCTION plperl_to_hstore(val internal) RETURNS @extschema:hstore@.hstore
1111
LANGUAGE C STRICT IMMUTABLE
1212
AS 'MODULE_PATHNAME';
1313

14-
CREATE TRANSFORM FOR hstore LANGUAGE plperl (
14+
CREATE TRANSFORM FOR @extschema:hstore@.hstore LANGUAGE plperl (
1515
FROM SQL WITH FUNCTION hstore_to_plperl(internal),
1616
TO SQL WITH FUNCTION plperl_to_hstore(internal)
1717
);

‎contrib/hstore_plperl/hstore_plperlu--1.0.sql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,11 @@ CREATE FUNCTION hstore_to_plperlu(val internal) RETURNS internal
77
LANGUAGE C STRICT IMMUTABLE
88
AS 'MODULE_PATHNAME', 'hstore_to_plperl';
99

10-
CREATE FUNCTION plperlu_to_hstore(val internal) RETURNS hstore
10+
CREATE FUNCTION plperlu_to_hstore(val internal) RETURNS @extschema:hstore@.hstore
1111
LANGUAGE C STRICT IMMUTABLE
1212
AS 'MODULE_PATHNAME', 'plperl_to_hstore';
1313

14-
CREATE TRANSFORM FOR hstore LANGUAGE plperlu (
14+
CREATE TRANSFORM FOR @extschema:hstore@.hstore LANGUAGE plperlu (
1515
FROM SQL WITH FUNCTION hstore_to_plperlu(internal),
1616
TO SQL WITH FUNCTION plperlu_to_hstore(internal)
1717
);

‎contrib/hstore_plpython/hstore_plpython3u--1.0.sql

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,13 @@ CREATE FUNCTION hstore_to_plpython3(val internal) RETURNS internal
77
LANGUAGE C STRICT IMMUTABLE
88
AS 'MODULE_PATHNAME', 'hstore_to_plpython';
99

10-
CREATE FUNCTION plpython3_to_hstore(val internal) RETURNS hstore
10+
CREATE FUNCTION plpython3_to_hstore(val internal) RETURNS @extschema:hstore@.hstore
1111
LANGUAGE C STRICT IMMUTABLE
1212
AS 'MODULE_PATHNAME', 'plpython_to_hstore';
1313

14-
CREATE TRANSFORM FOR hstore LANGUAGE plpython3u (
14+
CREATE TRANSFORM FOR @extschema:hstore@.hstore LANGUAGE plpython3u (
1515
FROM SQL WITH FUNCTION hstore_to_plpython3(internal),
1616
TO SQL WITH FUNCTION plpython3_to_hstore(internal)
1717
);
1818

19-
COMMENT ON TRANSFORM FOR hstore LANGUAGE plpython3u IS 'transform between hstore and Python dict';
19+
COMMENT ON TRANSFORM FOR @extschema:hstore@.hstore LANGUAGE plpython3u IS 'transform between hstore and Python dict';

‎contrib/ltree_plpython/ltree_plpython3u--1.0.sql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,6 @@ CREATE FUNCTION ltree_to_plpython3(val internal) RETURNS internal
77
LANGUAGE C STRICT IMMUTABLE
88
AS 'MODULE_PATHNAME', 'ltree_to_plpython';
99

10-
CREATE TRANSFORM FOR ltree LANGUAGE plpython3u (
10+
CREATE TRANSFORM FOR @extschema:ltree@.ltree LANGUAGE plpython3u (
1111
FROM SQL WITH FUNCTION ltree_to_plpython3(internal)
1212
);

‎doc/src/sgml/extend.sgml

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1348,15 +1348,11 @@ SELECT * FROM pg_extension_update_paths('<replaceable>extension_name</replaceabl
13481348
</para>
13491349

13501350
<para>
1351-
Cross-extension references are extremely difficult to make fully
1352-
secure, partially because of uncertainty about which schema the other
1353-
extension is in. The hazards are reduced if both extensions are
1354-
installed in the same schema, because then a hostile object cannot be
1355-
placed ahead of the referenced extension in the installation-time
1356-
<varname>search_path</varname>. However, no mechanism currently exists
1357-
to require that. For now, best practice is to not mark an extension
1358-
trusted if it depends on another one, unless that other one is always
1359-
installed in <literal>pg_catalog</literal>.
1351+
Secure cross-extension references typically require schema-qualification
1352+
of the names of the other extension's objects, using the
1353+
<literal>@extschema:<replaceable>name</replaceable>@</literal>
1354+
syntax, in addition to careful matching of argument types for functions
1355+
and operators.
13601356
</para>
13611357
</sect3>
13621358
</sect2>

‎doc/src/sgml/hstore.sgml

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -946,15 +946,6 @@ ALTER TABLE tablename ALTER hstorecol TYPE hstore USING hstorecol || '';
946946
extension for PL/Python is called <literal>hstore_plpython3u</literal>.
947947
If you use it, <type>hstore</type> values are mapped to Python dictionaries.
948948
</para>
949-
950-
<caution>
951-
<para>
952-
It is strongly recommended that the transform extensions be installed in
953-
the same schema as <filename>hstore</filename>. Otherwise there are
954-
installation-time security hazards if a transform extension's schema
955-
contains objects defined by a hostile user.
956-
</para>
957-
</caution>
958949
</sect2>
959950

960951
<sect2 id="hstore-authors">

‎doc/src/sgml/ltree.sgml

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -841,15 +841,6 @@ ltreetest=&gt; SELECT ins_label(path,2,'Space') FROM test WHERE path &lt;@ 'Top.
841841
creating a function, <type>ltree</type> values are mapped to Python lists.
842842
(The reverse is currently not supported, however.)
843843
</para>
844-
845-
<caution>
846-
<para>
847-
It is strongly recommended that the transform extension be installed in
848-
the same schema as <filename>ltree</filename>. Otherwise there are
849-
installation-time security hazards if a transform extension's schema
850-
contains objects defined by a hostile user.
851-
</para>
852-
</caution>
853844
</sect2>
854845

855846
<sect2 id="ltree-authors">

0 commit comments

Comments
 (0)
0