Re: Is this a security oversight?

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: Ben Tilly <btilly(at)gmail(dot)com>
Cc: pgsql-sql(at)lists(dot)postgresql(dot)org
Subject: Re: Is this a security oversight?
Date: 2021-08-10 18:32:10
Message-ID: 3825125.1628620330@sss.pgh.pa.us
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-sql

Ben Tilly <btilly(at)gmail(dot)com> writes:
> As a security rule, you cannot create a cast without owning one of the
> types.

Check.

> The following code successfully creates it, not as postgres and not as a
> superuser.

Really? When I try that as an ordinary user, I get

ERROR: must be owner of type boolean
CONTEXT: SQL statement "ALTER TYPE bool OWNER TO current_user"
PL/pgSQL function inline_code_block line 12 at SQL statement

If there is a way where that actually does work without superuser
privileges, please send the details to security(at)postgresql(dot)org(dot)

regards, tom lane

In response to

Responses

Browse pgsql-sql by date

  From Date Subject
Next Message Ben Tilly 2021-08-10 18:40:53 Re: Is this a security oversight?
Previous Message Ben Tilly 2021-08-10 17:41:48 Is this a security oversight?