pgsql: Reject empty names and recursion in config-file include directiv

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Reject empty names and recursion in config-file include directiv
Date: 2019-08-27 18:44:47
Message-ID: E1i2gSV-0004zR-4i@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Reject empty names and recursion in config-file include directives.

An empty file name or subdirectory name leads join_path_components() to
just produce the parent directory name, which leads to weird failures or
recursive inclusions. Let's throw a specific error for that. It takes
only slightly more code to detect all-blank names, so do so.

Also, detect direct recursion, ie a file calling itself. As coded
this will also detect recursion via "include_dir '.'", which is
perhaps more likely than explicitly including the file itself.

Detecting indirect recursion would require API changes for guc-file.l
functions, which seems not worth it since extensions might call them.
The nesting depth limit will catch such cases eventually, just not
with such an on-point error message.

In passing, adjust the example usages in postgresql.conf.sample
to perhaps eliminate the problem at the source: there's no reason
for the examples to suggest that an empty value is valid.

Per a trouble report from Brent Bates. Back-patch to 9.5; the
issue is old, but the code in 9.4 is enough different that the
patch doesn't apply easily, and it doesn't seem worth the trouble
to fix there.

Ian Barwick and Tom Lane

Discussion: https://postgr.es/m/8c8bcbca-3bd9-dc6e-8986-04a5abdef142@2ndquadrant.com

Branch
------
REL9_6_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/465f4dddae6bfe882f95e9e04633c7c496826ac2

Modified Files
--------------
src/backend/utils/misc/guc-file.l | 58 +++++++++++++++++++++++++++
src/backend/utils/misc/postgresql.conf.sample | 9 +++--
2 files changed, 63 insertions(+), 4 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Tom Lane 2019-08-27 19:14:59 pgsql: Add missing newline in help output.
Previous Message Michael Paquier 2019-08-27 03:44:33 Re: pgsql: Fix error handling of vacuumdb and reindexdb when running out of