This is an automated email from the ASF dual-hosted git repository. reshke pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit c8f13cb98e7c50d42f768060352caafb1b1c2402 Author: Nathan Bossart <[email protected]> AuthorDate: Mon Aug 10 06:38:25 2026 -0700 psql: Don't do backquote expansion in \unrestrict. This oversight in commit 71ea0d6795 allows a malicious server to inject shell commands into plain-text dump output that are run at restore time on the machine running psql. To fix, interpret all text after \unrestrict until the end of the line as its argument. Reported-by: Lucas Velgus <[email protected]> Reported-by: Filip Janus <[email protected]> Reported-by: Daniel Bakker <[email protected]> Author: Nathan Bossart <[email protected]> Reviewed-by: Robert Haas <[email protected]> Reviewed-by: Noah Misch <[email protected]> Security: CVE-2026-18408 Backpatch-through: 14 --- doc/src/sgml/ref/psql-ref.sgml | 5 +++++ src/bin/psql/command.c | 19 +++++++++++++++++-- src/bin/psql/t/001_basic.pl | 7 +++++++ 3 files changed, 29 insertions(+), 2 deletions(-) diff --git a/doc/src/sgml/ref/psql-ref.sgml b/doc/src/sgml/ref/psql-ref.sgml index 4a121a3e5da..03bdc63775b 100644 --- a/doc/src/sgml/ref/psql-ref.sgml +++ b/doc/src/sgml/ref/psql-ref.sgml @@ -3561,6 +3561,11 @@ testdb=> <userinput>\setenv LESS -imx4F</userinput> <application>pg_dumpall</application>, and <application>pg_restore</application>, but it may be useful elsewhere. </para> + <para> + Unlike most other meta-commands, the entire remainder of the line is + always taken to be the argument of <command>\unrestrict</command>, and + neither variable interpolation nor backquote expansion are performed. + </para> </listitem> </varlistentry> diff --git a/src/bin/psql/command.c b/src/bin/psql/command.c index ccd11f586b3..bacab5f7bb4 100644 --- a/src/bin/psql/command.c +++ b/src/bin/psql/command.c @@ -2379,6 +2379,12 @@ exec_command_restrict(PsqlScanState scan_state, bool active_branch, Assert(!restricted); + /* + * Unlike \unrestrict, this argument may safely undergo backquote and + * variable expansion: HandleSlashCmds() rejects \restrict in + * restricted mode before its argument is scanned, so we only get here + * when the input could execute such things anyway. + */ opt = psql_scan_slash_option(scan_state, OT_NORMAL, NULL, true); if (opt == NULL || opt[0] == '\0') { @@ -2692,14 +2698,23 @@ exec_command_unrestrict(PsqlScanState scan_state, bool active_branch, if (active_branch) { char *opt; + size_t len; - opt = psql_scan_slash_option(scan_state, OT_NORMAL, NULL, true); + opt = psql_scan_slash_option(scan_state, OT_WHOLE_LINE, NULL, true); if (opt == NULL || opt[0] == '\0') { pg_log_error("\\%s: missing required argument", cmd); return PSQL_CMD_ERROR; } + /* strip any trailing spaces and semicolons */ + len = strlen(opt); + while (len > 0 && + (opt[len - 1] == ';' || + (isascii((unsigned char) opt[len - 1]) && + isspace((unsigned char) opt[len - 1])))) + opt[--len] = '\0'; + if (!restricted) { pg_log_error("\\%s: not currently in restricted mode", cmd); @@ -2717,7 +2732,7 @@ exec_command_unrestrict(PsqlScanState scan_state, bool active_branch, } } else - ignore_slash_options(scan_state); + ignore_slash_whole_line(scan_state); return PSQL_CMD_SKIP_LINE; } diff --git a/src/bin/psql/t/001_basic.pl b/src/bin/psql/t/001_basic.pl index f5ec8fab1f3..b953e662a09 100644 --- a/src/bin/psql/t/001_basic.pl +++ b/src/bin/psql/t/001_basic.pl @@ -395,4 +395,11 @@ psql_fails_like( qr/backslash commands are restricted; only \\unrestrict is allowed/, 'meta-command in restrict mode fails'); +psql_fails_like( + $node, + qq{\\restrict test +\\unrestrict `echo test`}, + qr/wrong key/, + '\unrestrict does not do backquote expansion'); + done_testing(); --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
