Skip to content

Commit 952ff31

Browse files
nathan-bossartnathan-bossart
committed
Ensure cached plans are correctly marked as dependent on role.
If a CTE, subquery, sublink, security invoker view, or coercion projection references a table with row-level security policies, we neglected to mark the plan as potentially dependent on which role is executing it. This could lead to later executions in the same session returning or hiding rows that should have been hidden or returned instead. Reported-by: Wolfgang Walther Reviewed-by: Noah Misch Security: CVE-2024-10976 Backpatch-through: 12
1 parent e428cd0 commit 952ff31

File tree

5 files changed

+190
-6
lines changed

5 files changed

+190
-6
lines changed

‎src/backend/executor/functions.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1991,6 +1991,12 @@ check_sql_fn_retval_ext(List *queryTreeLists,
19911991
rtr->rtindex = 1;
19921992
newquery->jointree = makeFromExpr(list_make1(rtr), NULL);
19931993

1994+
/*
1995+
* Make sure the new query is marked as having row security if the
1996+
* original one does.
1997+
*/
1998+
newquery->hasRowSecurity = parse->hasRowSecurity;
1999+
19942000
/* Replace original query in the correct element of the query list */
19952001
lfirst(parse_cell) = newquery;
19962002
}

‎src/backend/rewrite/rewriteHandler.c

Lines changed: 61 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,12 @@ typedef struct acquireLocksOnSubLinks_context
5858
bool for_execute; /* AcquireRewriteLocks' forExecute param */
5959
} acquireLocksOnSubLinks_context;
6060

61+
typedef struct fireRIRonSubLink_context
62+
{
63+
List *activeRIRs;
64+
bool hasRowSecurity;
65+
} fireRIRonSubLink_context;
66+
6167
static bool acquireLocksOnSubLinks(Node *node,
6268
acquireLocksOnSubLinks_context *context);
6369
static Query *rewriteRuleAction(Query *parsetree,
@@ -1804,6 +1810,12 @@ ApplyRetrieveRule(Query *parsetree,
18041810
*/
18051811
rule_action = fireRIRrules(rule_action, activeRIRs);
18061812

1813+
/*
1814+
* Make sure the query is marked as having row security if the view query
1815+
* does.
1816+
*/
1817+
parsetree->hasRowSecurity |= rule_action->hasRowSecurity;
1818+
18071819
/*
18081820
* Now, plug the view query in as a subselect, converting the relation's
18091821
* original RTE to a subquery RTE.
@@ -1929,7 +1941,7 @@ markQueryForLocking(Query *qry, Node *jtnode,
19291941
* the SubLink's subselect link with the possibly-rewritten subquery.
19301942
*/
19311943
static bool
1932-
fireRIRonSubLink(Node *node, List *activeRIRs)
1944+
fireRIRonSubLink(Node *node, fireRIRonSubLink_context *context)
19331945
{
19341946
if (node == NULL)
19351947
return false;
@@ -1939,7 +1951,13 @@ fireRIRonSubLink(Node *node, List *activeRIRs)
19391951

19401952
/* Do what we came for */
19411953
sub->subselect = (Node *) fireRIRrules((Query *) sub->subselect,
1942-
activeRIRs);
1954+
context->activeRIRs);
1955+
1956+
/*
1957+
* Remember if any of the sublinks have row security.
1958+
*/
1959+
context->hasRowSecurity |= ((Query *) sub->subselect)->hasRowSecurity;
1960+
19431961
/* Fall through to process lefthand args of SubLink */
19441962
}
19451963

@@ -1948,7 +1966,7 @@ fireRIRonSubLink(Node *node, List *activeRIRs)
19481966
* subselects of subselects for us.
19491967
*/
19501968
return expression_tree_walker(node, fireRIRonSubLink,
1951-
(void *) activeRIRs);
1969+
(void *) context);
19521970
}
19531971

19541972

@@ -1992,6 +2010,13 @@ fireRIRrules(Query *parsetree, List *activeRIRs)
19922010
if (rte->rtekind == RTE_SUBQUERY)
19932011
{
19942012
rte->subquery = fireRIRrules(rte->subquery, activeRIRs);
2013+
2014+
/*
2015+
* While we are here, make sure the query is marked as having row
2016+
* security if any of its subqueries do.
2017+
*/
2018+
parsetree->hasRowSecurity |= rte->subquery->hasRowSecurity;
2019+
19952020
continue;
19962021
}
19972022

@@ -2105,16 +2130,35 @@ fireRIRrules(Query *parsetree, List *activeRIRs)
21052130

21062131
cte->ctequery = (Node *)
21072132
fireRIRrules((Query *) cte->ctequery, activeRIRs);
2133+
2134+
/*
2135+
* While we are here, make sure the query is marked as having row
2136+
* security if any of its CTEs do.
2137+
*/
2138+
parsetree->hasRowSecurity |= ((Query *) cte->ctequery)->hasRowSecurity;
21082139
}
21092140

21102141
/*
21112142
* Recurse into sublink subqueries, too. But we already did the ones in
21122143
* the rtable and cteList.
21132144
*/
21142145
if (parsetree->hasSubLinks)
2115-
query_tree_walker(parsetree, fireRIRonSubLink, (void *) activeRIRs,
2146+
{
2147+
fireRIRonSubLink_context context;
2148+
2149+
context.activeRIRs = activeRIRs;
2150+
context.hasRowSecurity = false;
2151+
2152+
query_tree_walker(parsetree, fireRIRonSubLink, (void *) &context,
21162153
QTW_IGNORE_RC_SUBQUERIES);
21172154

2155+
/*
2156+
* Make sure the query is marked as having row security if any of its
2157+
* sublinks do.
2158+
*/
2159+
parsetree->hasRowSecurity |= context.hasRowSecurity;
2160+
}
2161+
21182162
/*
21192163
* Apply any row level security policies. We do this last because it
21202164
* requires special recursion detection if the new quals have sublink
@@ -2153,6 +2197,7 @@ fireRIRrules(Query *parsetree, List *activeRIRs)
21532197
if (hasSubLinks)
21542198
{
21552199
acquireLocksOnSubLinks_context context;
2200+
fireRIRonSubLink_context fire_context;
21562201

21572202
/*
21582203
* Recursively process the new quals, checking for infinite
@@ -2183,11 +2228,21 @@ fireRIRrules(Query *parsetree, List *activeRIRs)
21832228
* Now that we have the locks on anything added by
21842229
* get_row_security_policies, fire any RIR rules for them.
21852230
*/
2231+
fire_context.activeRIRs = activeRIRs;
2232+
fire_context.hasRowSecurity = false;
2233+
21862234
expression_tree_walker((Node *) securityQuals,
2187-
fireRIRonSubLink, (void *) activeRIRs);
2235+
fireRIRonSubLink, (void *) &fire_context);
21882236

21892237
expression_tree_walker((Node *) withCheckOptions,
2190-
fireRIRonSubLink, (void *) activeRIRs);
2238+
fireRIRonSubLink, (void *) &fire_context);
2239+
2240+
/*
2241+
* We can ignore the value of fire_context.hasRowSecurity
2242+
* since we only reach this code in cases where hasRowSecurity
2243+
* is already true.
2244+
*/
2245+
Assert(hasRowSecurity);
21912246

21922247
activeRIRs = list_delete_last(activeRIRs);
21932248
}

‎src/test/regress/expected/rowsecurity.out

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4062,6 +4062,84 @@ execute q;
40624062
--------------+---
40634063
(0 rows)
40644064

4065+
-- make sure RLS dependencies in CTEs are handled
4066+
reset role;
4067+
create or replace function rls_f() returns setof rls_t
4068+
stable language sql
4069+
as $$ with cte as (select * from rls_t) select * from cte $$;
4070+
prepare r as select current_user, * from rls_f();
4071+
set role regress_rls_alice;
4072+
execute r;
4073+
current_user | c
4074+
-------------------+------------------
4075+
regress_rls_alice | invisible to bob
4076+
(1 row)
4077+
4078+
set role regress_rls_bob;
4079+
execute r;
4080+
current_user | c
4081+
--------------+---
4082+
(0 rows)
4083+
4084+
-- make sure RLS dependencies in subqueries are handled
4085+
reset role;
4086+
create or replace function rls_f() returns setof rls_t
4087+
stable language sql
4088+
as $$ select * from (select * from rls_t) _ $$;
4089+
prepare s as select current_user, * from rls_f();
4090+
set role regress_rls_alice;
4091+
execute s;
4092+
current_user | c
4093+
-------------------+------------------
4094+
regress_rls_alice | invisible to bob
4095+
(1 row)
4096+
4097+
set role regress_rls_bob;
4098+
execute s;
4099+
current_user | c
4100+
--------------+---
4101+
(0 rows)
4102+
4103+
-- make sure RLS dependencies in sublinks are handled
4104+
reset role;
4105+
create or replace function rls_f() returns setof rls_t
4106+
stable language sql
4107+
as $$ select exists(select * from rls_t)::text $$;
4108+
prepare t as select current_user, * from rls_f();
4109+
set role regress_rls_alice;
4110+
execute t;
4111+
current_user | c
4112+
-------------------+------
4113+
regress_rls_alice | true
4114+
(1 row)
4115+
4116+
set role regress_rls_bob;
4117+
execute t;
4118+
current_user | c
4119+
-----------------+-------
4120+
regress_rls_bob | false
4121+
(1 row)
4122+
4123+
-- make sure RLS dependencies are handled when coercion projections are inserted
4124+
reset role;
4125+
create or replace function rls_f() returns setof rls_t
4126+
stable language sql
4127+
as $$ select * from (select array_agg(c) as cs from rls_t) _ group by cs $$;
4128+
prepare u as select current_user, * from rls_f();
4129+
set role regress_rls_alice;
4130+
execute u;
4131+
current_user | c
4132+
-------------------+----------------------
4133+
regress_rls_alice | {"invisible to bob"}
4134+
(1 row)
4135+
4136+
set role regress_rls_bob;
4137+
execute u;
4138+
current_user | c
4139+
-----------------+---
4140+
regress_rls_bob |
4141+
(1 row)
4142+
40654143
RESET ROLE;
40664144
DROP FUNCTION rls_f();
40674145
DROP TABLE rls_t;

‎src/test/regress/sql/rowsecurity.sql

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1889,6 +1889,50 @@ execute q;
18891889
set role regress_rls_bob;
18901890
execute q;
18911891

1892+
-- make sure RLS dependencies in CTEs are handled
1893+
reset role;
1894+
create or replace function rls_f() returns setof rls_t
1895+
stable language sql
1896+
as $$ with cte as (select * from rls_t) select * from cte $$;
1897+
prepare r as select current_user, * from rls_f();
1898+
set role regress_rls_alice;
1899+
execute r;
1900+
set role regress_rls_bob;
1901+
execute r;
1902+
1903+
-- make sure RLS dependencies in subqueries are handled
1904+
reset role;
1905+
create or replace function rls_f() returns setof rls_t
1906+
stable language sql
1907+
as $$ select * from (select * from rls_t) _ $$;
1908+
prepare s as select current_user, * from rls_f();
1909+
set role regress_rls_alice;
1910+
execute s;
1911+
set role regress_rls_bob;
1912+
execute s;
1913+
1914+
-- make sure RLS dependencies in sublinks are handled
1915+
reset role;
1916+
create or replace function rls_f() returns setof rls_t
1917+
stable language sql
1918+
as $$ select exists(select * from rls_t)::text $$;
1919+
prepare t as select current_user, * from rls_f();
1920+
set role regress_rls_alice;
1921+
execute t;
1922+
set role regress_rls_bob;
1923+
execute t;
1924+
1925+
-- make sure RLS dependencies are handled when coercion projections are inserted
1926+
reset role;
1927+
create or replace function rls_f() returns setof rls_t
1928+
stable language sql
1929+
as $$ select * from (select array_agg(c) as cs from rls_t) _ group by cs $$;
1930+
prepare u as select current_user, * from rls_f();
1931+
set role regress_rls_alice;
1932+
execute u;
1933+
set role regress_rls_bob;
1934+
execute u;
1935+
18921936
RESET ROLE;
18931937
DROP FUNCTION rls_f();
18941938
DROP TABLE rls_t;

‎src/tools/pgindent/typedefs.list

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2950,6 +2950,7 @@ fill_string_relopt
29502950
finalize_primnode_context
29512951
find_dependent_phvs_context
29522952
find_expr_references_context
2953+
fireRIRonSubLink_context
29532954
fix_join_expr_context
29542955
fix_scan_expr_context
29552956
fix_upper_expr_context

0 commit comments

Comments
 (0)