This is an automated email from the ASF dual-hosted git repository. reshke pushed a commit to branch REL_2_STABLE in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit c1f6aa2473fbeb34c0763f847b065e33dab8c5be Author: Nathan Bossart <[email protected]> AuthorDate: Mon Aug 10 06:38:35 2026 -0700 Obstruct EXTRACT() field name deparse injection. The parser accepts any string as an EXTRACT() field name, but deparsing does not quote and escape it accordingly. To fix, quote and escape the field name during deparsing as needed. It might be a good idea to validate the field name during parsing and deparsing, too, but that is left as a future exercise. Reported-by: Ben Morris in collaboration with Claude and Anthropic Research Author: Nathan Bossart <[email protected]> Reviewed-by: Tom Lane <[email protected]> Reviewed-by: Etsuro Fujita <[email protected]> Security: CVE-2026-15741 Backpatch-through: 14 --- src/backend/utils/adt/ruleutils.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/backend/utils/adt/ruleutils.c b/src/backend/utils/adt/ruleutils.c index 5a25c76c775..186cb8fed16 100644 --- a/src/backend/utils/adt/ruleutils.c +++ b/src/backend/utils/adt/ruleutils.c @@ -10502,7 +10502,7 @@ get_func_sql_syntax(FuncExpr *expr, deparse_context *context) Assert(IsA(con, Const) && con->consttype == TEXTOID && !con->constisnull); - appendStringInfoString(buf, TextDatumGetCString(con->constvalue)); + appendStringInfoString(buf, quote_identifier(TextDatumGetCString(con->constvalue))); } appendStringInfoString(buf, " FROM "); get_rule_expr((Node *) lsecond(expr->args), context, false); @@ -10522,6 +10522,7 @@ get_func_sql_syntax(FuncExpr *expr, deparse_context *context) Assert(IsA(con, Const) && con->consttype == TEXTOID && !con->constisnull); + /* NB: safe because no allowed words need quoted/escaped */ appendStringInfo(buf, " %s", TextDatumGetCString(con->constvalue)); } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
