pgsql: Handle RLS dependencies in inlined set-returning functions prope - Mailing list pgsql-committers

Handle RLS dependencies in inlined set-returning functions properly.

If an SRF in the FROM clause references a table having row-level
security policies, and we inline that SRF into the calling query,
we neglected to mark the plan as potentially dependent on which
role is executing it.  This could lead to later executions in the
same session returning or hiding rows that should have been hidden
or returned instead.

Our thanks to Wolfgang Walther for reporting this problem.

Stephen Frost and Tom Lane

Security: CVE-2023-2455

Branch
------
REL_11_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/473626cf00babd829eb15c36b51dfb358d32bc95

Modified Files
--------------
src/backend/optimizer/util/clauses.c      |  7 +++++++
src/test/regress/expected/rowsecurity.out | 27 +++++++++++++++++++++++++++
src/test/regress/sql/rowsecurity.sql      | 20 ++++++++++++++++++++
3 files changed, 54 insertions(+)