Noah Misch <noah@leadboat.com> writes:
> security@ received a report about a regression in commit 2ebf25e. On
> 2026-09-12, I told the reporter that we handle defects in unreleased code as
> non-vulnerabilities and asked them to report it to pgsql-hackers. I didn't
> find that report, so I'm forwarding it here.
> ...
> The new SJE implementation groups the RTEs by physical relation OID without
> comparing their security qualifiers or permission identities.
Right. I think the appropriate fix is probably to require
that the checkAsUser values match in RTEs we want to combine.
If we do that, I'm not sure that we need to consider securityQuals
as such (but I've not tried it so maybe I'm missing something).
The code 2ebf25e7d removed doesn't appear to have any particular
consideration for either checkAsUser or securityQuals, so I wonder
how it worked before.
regards, tom lane
