This is an automated email from the ASF dual-hosted git repository. tuhaihe pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit 956914e2c7d668104b42a70f3cf95f90f2b38937 Author: Noah Misch <[email protected]> AuthorDate: Mon May 11 05:13:50 2026 -0700 Fix SQL injection in logical replication origin checks. ALTER SUBSCRIPTION ... REFRESH PUBLICATION interpolates schema and relation names into SQL without quoting them. A crafted subscriber relation name can inject arbitrary SQL on the publisher. Test such a name. Back-patch to v16, where commit 875693019053b8897ec3983e292acbb439b088c3 first appeared. Reported-by: Pavel Kohout <[email protected]> Author: Pavel Kohout <[email protected]> Reviewed-by: Nathan Bossart <[email protected]> Backpatch-through: 16 Security: CVE-2026-6638 --- src/backend/commands/subscriptioncmds.c | 9 +++++++-- src/test/subscription/t/030_origin.pl | 35 ++++++++++++++++++--------------- 2 files changed, 26 insertions(+), 18 deletions(-) diff --git a/src/backend/commands/subscriptioncmds.c b/src/backend/commands/subscriptioncmds.c index 3dac21f65d4..ff3f535bcea 100644 --- a/src/backend/commands/subscriptioncmds.c +++ b/src/backend/commands/subscriptioncmds.c @@ -2067,9 +2067,14 @@ check_publications_origin(WalReceiverConn *wrconn, List *publications, Oid relid = subrel_local_oids[i]; char *schemaname = get_namespace_name(get_rel_namespace(relid)); char *tablename = get_rel_name(relid); + char *schemaname_lit = quote_literal_cstr(schemaname); + char *tablename_lit = quote_literal_cstr(tablename); - appendStringInfo(&cmd, "AND NOT (N.nspname = '%s' AND C.relname = '%s')\n", - schemaname, tablename); + appendStringInfo(&cmd, "AND NOT (N.nspname = %s AND C.relname = %s)\n", + schemaname_lit, tablename_lit); + + pfree(schemaname_lit); + pfree(tablename_lit); } res = walrcv_exec(wrconn, cmd.data, 1, tableRow); diff --git a/src/test/subscription/t/030_origin.pl b/src/test/subscription/t/030_origin.pl index 0fa5874529b..3fda4a22d35 100644 --- a/src/test/subscription/t/030_origin.pl +++ b/src/test/subscription/t/030_origin.pl @@ -9,6 +9,9 @@ use PostgreSQL::Test::Cluster; use PostgreSQL::Test::Utils; use Test::More; +my $tab_unquoted = q{tab'le}; +my $tab = qq{"$tab_unquoted"}; + my $subname_AB = 'tap_sub_A_B'; my $subname_AB2 = 'tap_sub_A_B_2'; my $subname_BA = 'tap_sub_B_A'; @@ -33,15 +36,15 @@ $node_B->init(allows_streaming => 'logical'); $node_B->start; # Create table on node_A -$node_A->safe_psql('postgres', "CREATE TABLE tab (a int PRIMARY KEY)"); +$node_A->safe_psql('postgres', "CREATE TABLE $tab (a int PRIMARY KEY)"); # Create the same table on node_B -$node_B->safe_psql('postgres', "CREATE TABLE tab (a int PRIMARY KEY)"); +$node_B->safe_psql('postgres', "CREATE TABLE $tab (a int PRIMARY KEY)"); # Setup logical replication # node_A (pub) -> node_B (sub) my $node_A_connstr = $node_A->connstr . ' dbname=postgres'; -$node_A->safe_psql('postgres', "CREATE PUBLICATION tap_pub_A FOR TABLE tab"); +$node_A->safe_psql('postgres', "CREATE PUBLICATION tap_pub_A FOR TABLE $tab"); $node_B->safe_psql( 'postgres', " CREATE SUBSCRIPTION $subname_BA @@ -51,7 +54,7 @@ $node_B->safe_psql( # node_B (pub) -> node_A (sub) my $node_B_connstr = $node_B->connstr . ' dbname=postgres'; -$node_B->safe_psql('postgres', "CREATE PUBLICATION tap_pub_B FOR TABLE tab"); +$node_B->safe_psql('postgres', "CREATE PUBLICATION tap_pub_B FOR TABLE $tab"); $node_A->safe_psql( 'postgres', " CREATE SUBSCRIPTION $subname_AB @@ -71,25 +74,25 @@ is(1, 1, 'Bidirectional replication setup is complete'); ############################################################################### # insert a record -$node_A->safe_psql('postgres', "INSERT INTO tab VALUES (11);"); -$node_B->safe_psql('postgres', "INSERT INTO tab VALUES (21);"); +$node_A->safe_psql('postgres', "INSERT INTO $tab VALUES (11);"); +$node_B->safe_psql('postgres', "INSERT INTO $tab VALUES (21);"); $node_A->wait_for_catchup($subname_BA); $node_B->wait_for_catchup($subname_AB); # check that transaction was committed on subscriber(s) -$result = $node_A->safe_psql('postgres', "SELECT * FROM tab ORDER BY 1;"); +$result = $node_A->safe_psql('postgres', "SELECT * FROM $tab ORDER BY 1;"); is( $result, qq(11 21), 'Inserted successfully without leading to infinite recursion in bidirectional replication setup' ); -$result = $node_B->safe_psql('postgres', "SELECT * FROM tab ORDER BY 1;"); +$result = $node_B->safe_psql('postgres', "SELECT * FROM $tab ORDER BY 1;"); is( $result, qq(11 21), 'Inserted successfully without leading to infinite recursion in bidirectional replication setup' ); -$node_A->safe_psql('postgres', "DELETE FROM tab;"); +$node_A->safe_psql('postgres', "DELETE FROM $tab;"); $node_A->wait_for_catchup($subname_BA); $node_B->wait_for_catchup($subname_AB); @@ -98,10 +101,10 @@ $node_B->wait_for_catchup($subname_AB); # Check that remote data of node_B (that originated from node_C) is not # published to node_A. ############################################################################### -$result = $node_A->safe_psql('postgres', "SELECT * FROM tab ORDER BY 1;"); +$result = $node_A->safe_psql('postgres', "SELECT * FROM $tab ORDER BY 1;"); is($result, qq(), 'Check existing data'); -$result = $node_B->safe_psql('postgres', "SELECT * FROM tab ORDER BY 1;"); +$result = $node_B->safe_psql('postgres', "SELECT * FROM $tab ORDER BY 1;"); is($result, qq(), 'Check existing data'); # Initialize node node_C @@ -109,12 +112,12 @@ my $node_C = PostgreSQL::Test::Cluster->new('node_C'); $node_C->init(allows_streaming => 'logical'); $node_C->start; -$node_C->safe_psql('postgres', "CREATE TABLE tab (a int PRIMARY KEY)"); +$node_C->safe_psql('postgres', "CREATE TABLE $tab (a int PRIMARY KEY)"); # Setup logical replication # node_C (pub) -> node_B (sub) my $node_C_connstr = $node_C->connstr . ' dbname=postgres'; -$node_C->safe_psql('postgres', "CREATE PUBLICATION tap_pub_C FOR TABLE tab"); +$node_C->safe_psql('postgres', "CREATE PUBLICATION tap_pub_C FOR TABLE $tab"); $node_B->safe_psql( 'postgres', " CREATE SUBSCRIPTION $subname_BC @@ -124,17 +127,17 @@ $node_B->safe_psql( $node_B->wait_for_subscription_sync($node_C, $subname_BC); # insert a record -$node_C->safe_psql('postgres', "INSERT INTO tab VALUES (32);"); +$node_C->safe_psql('postgres', "INSERT INTO $tab VALUES (32);"); $node_C->wait_for_catchup($subname_BC); $node_B->wait_for_catchup($subname_AB); $node_A->wait_for_catchup($subname_BA); -$result = $node_B->safe_psql('postgres', "SELECT * FROM tab ORDER BY 1;"); +$result = $node_B->safe_psql('postgres', "SELECT * FROM $tab ORDER BY 1;"); is($result, qq(32), 'The node_C data replicated to node_B'); # check that the data published from node_C to node_B is not sent to node_A -$result = $node_A->safe_psql('postgres', "SELECT * FROM tab ORDER BY 1;"); +$result = $node_A->safe_psql('postgres', "SELECT * FROM $tab ORDER BY 1;"); is($result, qq(), 'Remote data originating from another node (not the publisher) is not replicated when origin parameter is none' ); --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
