From ffa2d37e5fbd1243f918f622113d6e371667e5a0 Mon Sep 17 00:00:00 2001 From: Noah Misch Date: Mon, 5 Aug 2019 07:48:41 -0700 Subject: Require the schema qualification in pg_temp.type_name(arg). Commit aa27977fe21a7dfa4da4376ad66ae37cb8f0d0b5 introduced this restriction for pg_temp.function_name(arg); do likewise for types created in temporary schemas. Programs that this breaks should add "pg_temp." schema qualification or switch to arg::type_name syntax. Back-patch to 9.4 (all supported versions). Reviewed by Tom Lane. Reported by Tom Lane. Security: CVE-2019-10208 --- src/backend/parser/parse_func.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'src/backend/parser/parse_func.c') diff --git a/src/backend/parser/parse_func.c b/src/backend/parser/parse_func.c index 4f3c59c0a29..8e926539e6a 100644 --- a/src/backend/parser/parse_func.c +++ b/src/backend/parser/parse_func.c @@ -1869,7 +1869,12 @@ FuncNameAsType(List *funcname) Oid result; Type typtup; - typtup = LookupTypeName(NULL, makeTypeNameFromNameList(funcname), NULL, false); + /* + * temp_ok=false protects the + * contract for writing SECURITY DEFINER functions safely. + */ + typtup = LookupTypeNameExtended(NULL, makeTypeNameFromNameList(funcname), + NULL, false, false); if (typtup == NULL) return InvalidOid; -- cgit v1.2.3