Re: copy.c handling for RLS is insecure - Mailing list pgsql-hackers

From Tom Lane
Subject Re: copy.c handling for RLS is insecure
Date
Msg-id 21901.1412622297@sss.pgh.pa.us
Whole thread Raw
In response to Re: copy.c handling for RLS is insecure  (Stephen Frost <sfrost@snowman.net>)
List pgsql-hackers
Stephen Frost <sfrost@snowman.net> writes:
> * Robert Haas (robertmhaas@gmail.com) wrote:
>> First, because relations are schema objects, there could be multiple
>> relations with the same name.  The RangeVar might end up referring to
>> a different one of those objects than the user originally specified.

> Argh.  That's certainly no good.  It should just be using the RangeVar
> relation passed in from CopyStmt, no?

No, it shouldn't be doing that either.  That would imply looking up the
relation a second time, and then you have a race condition against
concurrent renames (the same type of security bug Robert spent a great
deal of time on, not so long ago).

Once you've identified the target relation by OID, nothing else later in
the command should be doing a fresh lookup by name.  Period.  If you've
got APIs in here that depend on passing RangeVars to identify relations,
those APIs are broken and need to be changed.
        regards, tom lane



pgsql-hackers by date:

Previous
From: Peter Geoghegan
Date:
Subject: Re: Last Commitfest patches waiting review
Next
From: Robert Haas
Date:
Subject: Re: copy.c handling for RLS is insecure