This is an automated email from the ASF dual-hosted git repository. reshke pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit ad77f063dfe436e4faee7f2a74b56015e17d0d15 Author: Nathan Bossart <[email protected]> AuthorDate: Mon Aug 10 06:38:24 2026 -0700 Obstruct EXTRACT() field name deparse injection. The parser accepts any string as an EXTRACT() field name, but deparsing does not quote and escape it accordingly. To fix, quote and escape the field name during deparsing as needed. It might be a good idea to validate the field name during parsing and deparsing, too, but that is left as a future exercise. Reported-by: Ben Morris in collaboration with Claude and Anthropic Research Author: Nathan Bossart <[email protected]> Reviewed-by: Tom Lane <[email protected]> Reviewed-by: Etsuro Fujita <[email protected]> Security: CVE-2026-15741 Backpatch-through: 14 --- src/backend/utils/adt/ruleutils.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/backend/utils/adt/ruleutils.c b/src/backend/utils/adt/ruleutils.c index fd9c4daea67..7e07dd2e15a 100644 --- a/src/backend/utils/adt/ruleutils.c +++ b/src/backend/utils/adt/ruleutils.c @@ -10881,7 +10881,7 @@ get_func_sql_syntax(FuncExpr *expr, deparse_context *context) Assert(IsA(con, Const) && con->consttype == TEXTOID && !con->constisnull); - appendStringInfoString(buf, TextDatumGetCString(con->constvalue)); + appendStringInfoString(buf, quote_identifier(TextDatumGetCString(con->constvalue))); } appendStringInfoString(buf, " FROM "); get_rule_expr((Node *) lsecond(expr->args), context, false); @@ -10901,6 +10901,7 @@ get_func_sql_syntax(FuncExpr *expr, deparse_context *context) Assert(IsA(con, Const) && con->consttype == TEXTOID && !con->constisnull); + /* NB: safe because no allowed words need quoted/escaped */ appendStringInfo(buf, " %s", TextDatumGetCString(con->constvalue)); } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
