Re: Prevent object capture in CREATE/ALTER EXTENSION scripts

Hi solai,

On 22.09.26 06:13, solai v wrote:

[...]

> Overall, the patch worked as expected in my testing. The extension
> script now selects the trusted candidate instead of the attacker-owned
> candidate when both overloads are present.

Thank you so much for the review.

While testing the patch further, I found a gap with schema-qualified
names. In v1, the trust check for relations and types was applied only
when the script used an unqualified name and the lookup went through
RelnameGetRelid() or TypenameGetTypidExtended(). A reference such as
@extschema(at)(dot)foo took the qualified branch of RangeVarGetRelidExtended()
or LookupTypeNameExtended() and was not checked at all. Functions and
operators were not affected, since their candidate lookup handles both
versions in one place.

v2 adds the check to those two branches, so an untrusted match is
treated as nonexistent there too. I also added tests for this case; I
slightly adjusted the commit message and rebased the patch set against
master.

Best regards
Jan

--
Jan Nidzwetzki
PlanetScale Postgres Core Team