From d389415ffad509f0de1342e6ebbb5d5c62dbedef Mon Sep 17 00:00:00 2001 From: Nathan Bossart Date: Mon, 11 May 2026 05:13:47 -0700 Subject: [PATCH] pg_createsubscriber: Obstruct SQL injection via subscription names. drop_existing_subscription() neglected to escape the subscription name when generating its query string. To fix, use PQescapeIdentifier() to construct a properly escaped name, and use it in the ALTER SUBSCRIPTION and DROP SUBSCRIPTION commands. Reported-by: Yu Kunpeng Author: Nathan Bossart Reviewed-by: Amit Kapila Security: CVE-2026-6476 Backpatch-through: 17 --- src/bin/pg_basebackup/pg_createsubscriber.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/bin/pg_basebackup/pg_createsubscriber.c b/src/bin/pg_basebackup/pg_createsubscriber.c index 809626f4af3..81d3c78b805 100644 --- a/src/bin/pg_basebackup/pg_createsubscriber.c +++ b/src/bin/pg_basebackup/pg_createsubscriber.c @@ -1257,18 +1257,23 @@ drop_existing_subscription(PGconn *conn, const char *subname, const char *dbname { PQExpBuffer query = createPQExpBuffer(); PGresult *res; + char *subname_esc; Assert(conn != NULL); + subname_esc = PQescapeIdentifier(conn, subname, strlen(subname)); + /* * Construct a query string. These commands are allowed to be executed * within a transaction. */ appendPQExpBuffer(query, "ALTER SUBSCRIPTION %s DISABLE;", - subname); + subname_esc); appendPQExpBuffer(query, " ALTER SUBSCRIPTION %s SET (slot_name = NONE);", - subname); - appendPQExpBuffer(query, " DROP SUBSCRIPTION %s;", subname); + subname_esc); + appendPQExpBuffer(query, " DROP SUBSCRIPTION %s;", subname_esc); + + PQfreemem(subname_esc); if (dry_run) pg_log_info("dry-run: would drop subscription \"%s\" in database \"%s\"",