mirror of
https://github.com/postgres/postgres.git
synced 2026-03-11 10:45:17 -04:00
67a2fbb8f9
A malicious server could inject psql meta-commands into plain-text dump output (i.e., scripts created with pg_dump --format=plain, pg_dumpall, or pg_restore --file) that are run at restore time on the machine running psql. To fix, introduce a new "restricted" mode in psql that blocks all meta-commands (except for \unrestrict to exit the mode), and teach pg_dump, pg_dumpall, and pg_restore to use this mode in plain-text dumps. While at it, encourage users to only restore dumps generated from trusted servers or to inspect it beforehand, since restoring causes the destination to execute arbitrary code of the source superusers' choice. However, the client running the dump and restore needn't trust the source or destination superusers. Reported-by: Martin Rakhmanov Reported-by: Matthieu Denais <litezeraw@gmail.com> Reported-by: RyotaK <ryotak.mail@gmail.com> Suggested-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Michael Paquier <michael@paquier.xyz> Reviewed-by: Peter Eisentraut <peter@eisentraut.org> Security: CVE-2025-8714 Backpatch-through: 13
71 lines
2.5 KiB
C
71 lines
2.5 KiB
C
/*-------------------------------------------------------------------------
|
|
*
|
|
* Utility routines for SQL dumping
|
|
*
|
|
* Basically this is stuff that is useful in both pg_dump and pg_dumpall.
|
|
*
|
|
*
|
|
* Portions Copyright (c) 1996-2025, PostgreSQL Global Development Group
|
|
* Portions Copyright (c) 1994, Regents of the University of California
|
|
*
|
|
* src/bin/pg_dump/dumputils.h
|
|
*
|
|
*-------------------------------------------------------------------------
|
|
*/
|
|
#ifndef DUMPUTILS_H
|
|
#define DUMPUTILS_H
|
|
|
|
#include "libpq-fe.h"
|
|
#include "pqexpbuffer.h"
|
|
|
|
/*
|
|
* Preferred strftime(3) format specifier for printing timestamps in pg_dump
|
|
* and friends.
|
|
*
|
|
* We don't print the timezone on Windows, because the names are long and
|
|
* localized, which means they may contain characters in various random
|
|
* encodings; this has been seen to cause encoding errors when reading the
|
|
* dump script. Think not to get around that by using %z, because
|
|
* (1) %z is not portable to pre-C99 systems, and
|
|
* (2) %z doesn't actually act differently from %Z on Windows anyway.
|
|
*/
|
|
#ifndef WIN32
|
|
#define PGDUMP_STRFTIME_FMT "%Y-%m-%d %H:%M:%S %Z"
|
|
#else
|
|
#define PGDUMP_STRFTIME_FMT "%Y-%m-%d %H:%M:%S"
|
|
#endif
|
|
|
|
|
|
extern char *sanitize_line(const char *str, bool want_hyphen);
|
|
extern bool buildACLCommands(const char *name, const char *subname, const char *nspname,
|
|
const char *type, const char *acls, const char *baseacls,
|
|
const char *owner, const char *prefix, int remoteVersion,
|
|
PQExpBuffer sql);
|
|
extern bool buildDefaultACLCommands(const char *type, const char *nspname,
|
|
const char *acls, const char *acldefault,
|
|
const char *owner,
|
|
int remoteVersion,
|
|
PQExpBuffer sql);
|
|
|
|
extern void quoteAclUserName(PQExpBuffer output, const char *input);
|
|
|
|
extern void buildShSecLabelQuery(const char *catalog_name,
|
|
Oid objectId, PQExpBuffer sql);
|
|
extern void emitShSecLabels(PGconn *conn, PGresult *res,
|
|
PQExpBuffer buffer, const char *objtype, const char *objname);
|
|
|
|
extern bool variable_is_guc_list_quote(const char *name);
|
|
|
|
extern bool SplitGUCList(char *rawstring, char separator,
|
|
char ***namelist);
|
|
|
|
extern void makeAlterConfigCommand(PGconn *conn, const char *configitem,
|
|
const char *type, const char *name,
|
|
const char *type2, const char *name2,
|
|
PQExpBuffer buf);
|
|
extern void create_or_open_dir(const char *dirname);
|
|
|
|
extern char *generate_restrict_key(void);
|
|
extern bool valid_restrict_key(const char *restrict_key);
|
|
|
|
#endif /* DUMPUTILS_H */
|