From: | Andres Freund <andres(at)anarazel(dot)de> |
---|---|
To: | Robert Haas <robertmhaas(at)gmail(dot)com> |
Cc: | Mark Dilger <mark(dot)dilger(at)enterprisedb(dot)com>, Jeff Davis <pgsql(at)j-davis(dot)com>, Amit Kapila <amit(dot)kapila16(at)gmail(dot)com>, Andrew Dunstan <andrew(at)dunslane(dot)net>, PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: Non-superuser subscription owners |
Date: | 2023-01-21 22:10:57 |
Message-ID: | 20230121221057.cegjbybv4istuwme@awork3.anarazel.de |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
Hi,
On 2023-01-20 11:08:54 -0500, Robert Haas wrote:
> /*
> - * Validate connection info string (just try to parse it)
> + * Validate connection info string, and determine whether it might cause
> + * local filesystem access to be attempted.
> + *
> + * If the connection string can't be parsed, this function will raise
> + * an error and will not return. If it can, it will return true if local
> + * filesystem access may be attempted and false otherwise.
> */
> -static void
> +static bool
> libpqrcv_check_conninfo(const char *conninfo)
> {
> PQconninfoOption *opts = NULL;
> + PQconninfoOption *opt;
> char *err = NULL;
> + bool result = false;
>
> opts = PQconninfoParse(conninfo, &err);
> if (opts == NULL)
> @@ -267,7 +274,40 @@ libpqrcv_check_conninfo(const char *conninfo)
> errmsg("invalid connection string syntax: %s", errcopy)));
> }
>
> + for (opt = opts; opt->keyword != NULL; ++opt)
> + {
> + /* Ignore connection options that are not present. */
> + if (opt->val == NULL)
> + continue;
> +
> + /* For all these parameters, the value is a local filename. */
> + if (strcmp(opt->keyword, "passfile") == 0 ||
> + strcmp(opt->keyword, "sslcert") == 0 ||
> + strcmp(opt->keyword, "sslkey") == 0 ||
> + strcmp(opt->keyword, "sslrootcert") == 0 ||
> + strcmp(opt->keyword, "sslcrl") == 0 ||
> + strcmp(opt->keyword, "sslcrldir") == 0 ||
> + strcmp(opt->keyword, "service") == 0)
> + {
> + result = true;
> + break;
> + }
Do we need to think about 'options' allowing anything bad? I don't
immediately* see a problem, but ...
> +
> + /*
> + * For the host parameter, the value might be a local filename.
> + * It might also be a reference to the local host's abstract UNIX
> + * socket namespace, which we consider equivalent to a local pathname
> + * for security purporses.
> + */
> + if (strcmp(opt->keyword, "host") == 0 && is_unixsock_path(opt->val))
> + {
> + result = true;
> + break;
> + }
> + }
Hm, what about kerberos / gss / SSPI? Aren't those essentially also tied to
the local filesystem / user?
Greetings,
Andres Freund
From | Date | Subject | |
---|---|---|---|
Next Message | Tom Lane | 2023-01-21 22:20:35 | Re: run pgindent on a regular basis / scripted manner |
Previous Message | Peter Geoghegan | 2023-01-21 22:05:41 | Re: run pgindent on a regular basis / scripted manner |