This is an automated email from the ASF dual-hosted git repository. reshke pushed a commit to branch REL_2_STABLE in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit 00f13ea679958cf784a7174d87b15bb76f07d6cf Author: Nathan Bossart <[email protected]> AuthorDate: Mon Aug 10 06:38:37 2026 -0700 psql: Don't do backquote expansion in \unrestrict. This oversight in commit 71ea0d6795 allows a malicious server to inject shell commands into plain-text dump output that are run at restore time on the machine running psql. To fix, interpret all text after \unrestrict until the end of the line as its argument. Reported-by: Lucas Velgus <[email protected]> Reported-by: Filip Janus <[email protected]> Reported-by: Daniel Bakker <[email protected]> Author: Nathan Bossart <[email protected]> Reviewed-by: Robert Haas <[email protected]> Reviewed-by: Noah Misch <[email protected]> Security: CVE-2026-18408 Backpatch-through: 14 --- doc/src/sgml/ref/psql-ref.sgml | 5 +++++ src/bin/psql/command.c | 19 +++++++++++++++++-- 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/doc/src/sgml/ref/psql-ref.sgml b/doc/src/sgml/ref/psql-ref.sgml index f7c1ccad02e..74f138b0b0a 100644 --- a/doc/src/sgml/ref/psql-ref.sgml +++ b/doc/src/sgml/ref/psql-ref.sgml @@ -3407,6 +3407,11 @@ testdb=> <userinput>\setenv LESS -imx4F</userinput> <application>pg_dumpall</application>, and <application>pg_restore</application>, but it may be useful elsewhere. </para> + <para> + Unlike most other meta-commands, the entire remainder of the line is + always taken to be the argument of <command>\unrestrict</command>, and + neither variable interpolation nor backquote expansion are performed. + </para> </listitem> </varlistentry> diff --git a/src/bin/psql/command.c b/src/bin/psql/command.c index f72b3c4b234..530a7a4bdf5 100644 --- a/src/bin/psql/command.c +++ b/src/bin/psql/command.c @@ -2286,6 +2286,12 @@ exec_command_restrict(PsqlScanState scan_state, bool active_branch, Assert(!restricted); + /* + * Unlike \unrestrict, this argument may safely undergo backquote and + * variable expansion: HandleSlashCmds() rejects \restrict in + * restricted mode before its argument is scanned, so we only get here + * when the input could execute such things anyway. + */ opt = psql_scan_slash_option(scan_state, OT_NORMAL, NULL, true); if (opt == NULL || opt[0] == '\0') { @@ -2614,14 +2620,23 @@ exec_command_unrestrict(PsqlScanState scan_state, bool active_branch, if (active_branch) { char *opt; + size_t len; - opt = psql_scan_slash_option(scan_state, OT_NORMAL, NULL, true); + opt = psql_scan_slash_option(scan_state, OT_WHOLE_LINE, NULL, true); if (opt == NULL || opt[0] == '\0') { pg_log_error("\\%s: missing required argument", cmd); return PSQL_CMD_ERROR; } + /* strip any trailing spaces and semicolons */ + len = strlen(opt); + while (len > 0 && + (opt[len - 1] == ';' || + (isascii((unsigned char) opt[len - 1]) && + isspace((unsigned char) opt[len - 1])))) + opt[--len] = '\0'; + if (!restricted) { pg_log_error("\\%s: not currently in restricted mode", cmd); @@ -2639,7 +2654,7 @@ exec_command_unrestrict(PsqlScanState scan_state, bool active_branch, } } else - ignore_slash_options(scan_state); + ignore_slash_whole_line(scan_state); return PSQL_CMD_SKIP_LINE; } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
