Thread: Re: Accessing other session's temp table

Mikhail Gribkov <youzhick@gmail.com> writes:
> What do you think?

I think this will break cases we don't want to break.

Accessing the metadata of other temp tables is fine, and indeed
necessary for operations like dropping them.  It's access to
the table contents that needs to be blocked.  I'm surprised
that we don't have sufficient tests at that level.

[ experiments... ]  It looks like this did work as expected up
through v15.  So somebody broke it fairly recently, perhaps
as a side effect of the table-AM work.  Might be worth bisecting
to see where it broke.

(Realistically though, this is all only a problem for superusers,
who are supposed to Know Better.  For ordinary users the permissions
set on temp schemas ought to be enough to prevent such things.)

            regards, tom lane

On Wed, Nov 20, 2024 at 5:47 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
>
> Mikhail Gribkov <youzhick@gmail.com> writes:
> > What do you think?
>
> I think this will break cases we don't want to break.
>
> Accessing the metadata of other temp tables is fine, and indeed
> necessary for operations like dropping them.  It's access to
> the table contents that needs to be blocked.  I'm surprised
> that we don't have sufficient tests at that level.
>
> [ experiments... ]  It looks like this did work as expected up
> through v15.  So somebody broke it fairly recently, perhaps
> as a side effect of the table-AM work.  Might be worth bisecting
> to see where it broke.

Yeah, this is really odd. I don't understand why the first insert
didn't immediately fail, right here, in ReadBufferExtended:

    /*
     * Reject attempts to read non-local temporary relations; we would be
     * likely to get wrong data since we have no visibility into the owning
     * session's local buffers.
     */
    if (RELATION_IS_OTHER_TEMP(reln))
        ereport(ERROR,
                (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
                 errmsg("cannot access temporary tables of other sessions")));

--
Robert Haas
EDB: http://www.enterprisedb.com