Always require SELECT permission for ON CONFLICT DO UPDATE.

Enterprise / PostgreSQL - Dean Rasheed [gmail.com] - 6 November 2017 09:19 EST

The update path of an INSERT ... ON CONFLICT DO UPDATE requires SELECT permission on the columns of the arbiter index, but it failed to check for that in the case of an arbiter specified by constraint name.

In addition, for a table with row level security enabled, it failed to check updated rows against the table's SELECT policies when the update path was taken (regardless of how the arbiter index was specified).

Backpatch to 9.5 where ON CONFLICT DO UPDATE and RLS were introduced.

Security: CVE-2017-15099

87b2ebd352 Always require SELECT permission for ON CONFLICT DO UPDATE.
src/backend/catalog/pg_constraint.c | 98 +++++++++++++++++++++++++++++++
src/backend/parser/parse_clause.c | 21 ++++++-
src/backend/rewrite/rowsecurity.c | 20 ++++++-
src/include/catalog/pg_constraint_fn.h | 2 +
src/test/regress/expected/privileges.out | 16 ++++-
src/test/regress/expected/rowsecurity.out | 15 ++++-
src/test/regress/sql/privileges.sql | 19 +++++-
src/test/regress/sql/rowsecurity.sql | 14 ++++-
8 files changed, 194 insertions(+), 11 deletions(-)

Upstream: git.postgresql.org


  • Share