Re: BUG #19523: psql tab-completion shadows pg_db_role_setting

From: Vismay Tiwari <vismay(dot)t(at)gmail(dot)com>
To: pgsql-bugs(at)lists(dot)postgresql(dot)org
Subject: Re: BUG #19523: psql tab-completion shadows pg_db_role_setting
Date: 2026-07-09 10:13:50
Message-ID: CALHMmB84qkCgv3QAR78YawgfqQZCxSPkRhppxzU=e6fg8RA+AA@mail.gmail.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

Hi,

Reproduced on current master. The tab-completion query for
"ALTER DATABASE ... RESET" (Query_for_list_of_database_vars) references
pg_db_role_setting and pg_database without a pg_catalog qualification, so a
same-named table earlier in search_path shadows the catalog:

CREATE SCHEMA attacker;
CREATE TABLE attacker.pg_db_role_setting (setdatabase oid, setrole
oid, setconfig text[]);
INSERT INTO attacker.pg_db_role_setting
SELECT oid, 0, ARRAY['evil_var=x'] FROM pg_database WHERE
datname = 'postgres';
SET search_path = attacker, pg_catalog;
-- "ALTER DATABASE postgres RESET <TAB>" then offers evil_var

The attached patch qualifies both catalogs with pg_catalog, matching the
qualification already used for unnest()/split_part() in the same query and for
the catalogs in the analogous subscription-variable completion query.

No test is included -- tab-completion query internals aren't covered by the
TAP suite, and this follows the earlier qualification fixes in the same area.
Affects v18 and master (the query was added in v18).

Regards,
Vismay Tiwari

Attachment Content-Type Size
v1-0001-psql-schema-qualify-catalog-references-in-a-tab-c.patch application/octet-stream 1.6 KB

Browse pgsql-bugs by date

  From Date Subject
Previous Message Konstantin Knizhnik 2026-07-09 10:08:43 Re: BUG #19519: REPACK can fail due to missing chunk for toast value