This is an automated email from the ASF dual-hosted git repository.

reshke pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cloudberry.git

commit ad77f063dfe436e4faee7f2a74b56015e17d0d15
Author: Nathan Bossart <[email protected]>
AuthorDate: Mon Aug 10 06:38:24 2026 -0700

    Obstruct EXTRACT() field name deparse injection.
    
    The parser accepts any string as an EXTRACT() field name, but
    deparsing does not quote and escape it accordingly.  To fix, quote
    and escape the field name during deparsing as needed.  It might be
    a good idea to validate the field name during parsing and
    deparsing, too, but that is left as a future exercise.
    
    Reported-by: Ben Morris in collaboration with Claude and Anthropic Research
    Author: Nathan Bossart <[email protected]>
    Reviewed-by: Tom Lane <[email protected]>
    Reviewed-by: Etsuro Fujita <[email protected]>
    Security: CVE-2026-15741
    Backpatch-through: 14
---
 src/backend/utils/adt/ruleutils.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/backend/utils/adt/ruleutils.c 
b/src/backend/utils/adt/ruleutils.c
index fd9c4daea67..7e07dd2e15a 100644
--- a/src/backend/utils/adt/ruleutils.c
+++ b/src/backend/utils/adt/ruleutils.c
@@ -10881,7 +10881,7 @@ get_func_sql_syntax(FuncExpr *expr, deparse_context 
*context)
                                Assert(IsA(con, Const) &&
                                           con->consttype == TEXTOID &&
                                           !con->constisnull);
-                               appendStringInfoString(buf, 
TextDatumGetCString(con->constvalue));
+                               appendStringInfoString(buf, 
quote_identifier(TextDatumGetCString(con->constvalue)));
                        }
                        appendStringInfoString(buf, " FROM ");
                        get_rule_expr((Node *) lsecond(expr->args), context, 
false);
@@ -10901,6 +10901,7 @@ get_func_sql_syntax(FuncExpr *expr, deparse_context 
*context)
                                Assert(IsA(con, Const) &&
                                           con->consttype == TEXTOID &&
                                           !con->constisnull);
+                               /* NB: safe because no allowed words need 
quoted/escaped */
                                appendStringInfo(buf, " %s",
                                                                 
TextDatumGetCString(con->constvalue));
                        }


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to