From c2e08b04c9e71ac6aabdc7d9b3f8e785e164d770 Mon Sep 17 00:00:00 2001 From: Dean Rasheed Date: Mon, 7 Aug 2023 09:28:47 +0100 Subject: Fix RLS policy usage in MERGE. If MERGE executes an UPDATE action on a table with row-level security, the code incorrectly applied the WITH CHECK clauses from the target table's INSERT policies to new rows, instead of the clauses from the table's UPDATE policies. In addition, it failed to check new rows against the target table's SELECT policies, if SELECT permissions were required (likely to always be the case). In addition, if MERGE executes a DO NOTHING action for matched rows, the code incorrectly applied the USING clauses from the target table's DELETE policies to existing target tuples. These policies were applied as checks that would throw an error, if they did not pass. Fix this, so that a MERGE UPDATE action applies the same RLS policies as a plain UPDATE query with a WHERE clause, and a DO NOTHING action does not apply any RLS checks (other than adding clauses from SELECT policies to the join). Back-patch to v15, where MERGE was introduced. Dean Rasheed, reviewed by Stephen Frost. Security: CVE-2023-39418 --- src/backend/executor/nodeModifyTable.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'src/backend/executor/nodeModifyTable.c') diff --git a/src/backend/executor/nodeModifyTable.c b/src/backend/executor/nodeModifyTable.c index 2a5fec8d017..5005d8c0d12 100644 --- a/src/backend/executor/nodeModifyTable.c +++ b/src/backend/executor/nodeModifyTable.c @@ -2861,13 +2861,14 @@ lmerge_matched: * UPDATE/DELETE RLS policies. If those checks fail, we throw an * error. * - * The WITH CHECK quals are applied in ExecUpdate() and hence we need - * not do anything special to handle them. + * The WITH CHECK quals for UPDATE RLS policies are applied in + * ExecUpdateAct() and hence we need not do anything special to handle + * them. * * NOTE: We must do this after WHEN quals are evaluated, so that we * check policies only when they matter. */ - if (resultRelInfo->ri_WithCheckOptions) + if (resultRelInfo->ri_WithCheckOptions && commandType != CMD_NOTHING) { ExecWithCheckOptions(commandType == CMD_UPDATE ? WCO_RLS_MERGE_UPDATE_CHECK : WCO_RLS_MERGE_DELETE_CHECK, -- cgit v1.2.3