From d22f9c319e9bde2c43fd5bee7e3feae63115a402 Mon Sep 17 00:00:00 2001 From: Yogesh Sharma Date: Mon, 24 Aug 2026 14:27:50 +0000 Subject: [PATCH v1] Clarify whose code a restore executes in the dump/restore warning The warning added by 71ea0d6795 says restoring a dump causes the destination to execute arbitrary code of the source superusers' choice. That understates the exposure: any source role that owns a dumped object can supply code the destination executes. A CHECK constraint is inlined into CREATE TABLE and enforced as each row is loaded by COPY. A stored generated column is omitted from the COPY column list, so its expression is recomputed during that same load. Both run with the privileges of the role performing the restore, which need not be the object's owner. A domain's CHECK constraint behaves the same way. The superuser scoping is apt for the psql meta-command vector that commit addressed, which executes on the client. It is too narrow for the destination-server execution described in the same sentence, which needs only a source object owner. The distinction matters when the source superusers are trusted but the source's ordinary object owners are not, as in a multi-tenant source. pg_upgrade's reference page carries a shorter form of this warning and is left alone: it restores schema only, so no COPY runs and neither expression is evaluated. The mitigation is unchanged: inspect the dumped statements before restoring. Keep the three pg_dump-family reference pages carrying this warning in sync. --- doc/src/sgml/ref/pg_dump.sgml | 16 ++++++++++------ doc/src/sgml/ref/pg_dumpall.sgml | 12 ++++++++---- doc/src/sgml/ref/pg_restore.sgml | 16 ++++++++++------ 3 files changed, 28 insertions(+), 16 deletions(-) diff --git a/doc/src/sgml/ref/pg_dump.sgml b/doc/src/sgml/ref/pg_dump.sgml index 774be23b4f9..04be5e6675d 100644 --- a/doc/src/sgml/ref/pg_dump.sgml +++ b/doc/src/sgml/ref/pg_dump.sgml @@ -99,12 +99,16 @@ PostgreSQL documentation Restoring a dump causes the destination to execute arbitrary code of the - source superusers' choice. Partial dumps and partial restores do not limit - that. If the source superusers are not trusted, the dumped SQL statements - must be inspected before restoring. Non-plain-text dumps can be inspected - by using pg_restore's - option. Note that the client running the dump and restore need not trust - the source or destination superusers. + source superusers' choice, or of the choice of any role that owns a + dumped object. For example, a table owner can supply such code through + a CHECK constraint or a generated column expression, + which the destination evaluates as it loads the table's rows. Partial + dumps and partial restores do not limit that. If those roles are not + trusted, the dumped SQL statements must be inspected before restoring. + Non-plain-text dumps can be inspected by using + pg_restore's option. + Note that the client running the dump and restore need not trust the + source or destination superusers. diff --git a/doc/src/sgml/ref/pg_dumpall.sgml b/doc/src/sgml/ref/pg_dumpall.sgml index 238c87c13f5..f8cd894af43 100644 --- a/doc/src/sgml/ref/pg_dumpall.sgml +++ b/doc/src/sgml/ref/pg_dumpall.sgml @@ -69,10 +69,14 @@ PostgreSQL documentation Restoring a dump causes the destination to execute arbitrary code of the - source superusers' choice. Partial dumps and partial restores do not limit - that. If the source superusers are not trusted, the dumped SQL statements - must be inspected before restoring. Note that the client running the dump - and restore need not trust the source or destination superusers. + source superusers' choice, or of the choice of any role that owns a + dumped object. For example, a table owner can supply such code through + a CHECK constraint or a generated column expression, + which the destination evaluates as it loads the table's rows. Partial + dumps and partial restores do not limit that. If those roles are not + trusted, the dumped SQL statements must be inspected before restoring. + Note that the client running the dump and restore need not trust the + source or destination superusers. diff --git a/doc/src/sgml/ref/pg_restore.sgml b/doc/src/sgml/ref/pg_restore.sgml index b6c5299c36e..fbe59543487 100644 --- a/doc/src/sgml/ref/pg_restore.sgml +++ b/doc/src/sgml/ref/pg_restore.sgml @@ -72,12 +72,16 @@ PostgreSQL documentation Restoring a dump causes the destination to execute arbitrary code of the - source superusers' choice. Partial dumps and partial restores do not limit - that. If the source superusers are not trusted, the dumped SQL statements - must be inspected before restoring. Non-plain-text dumps can be inspected - by using pg_restore's - option. Note that the client running the dump and restore need not trust - the source or destination superusers. + source superusers' choice, or of the choice of any role that owns a + dumped object. For example, a table owner can supply such code through + a CHECK constraint or a generated column expression, + which the destination evaluates as it loads the table's rows. Partial + dumps and partial restores do not limit that. If those roles are not + trusted, the dumped SQL statements must be inspected before restoring. + Non-plain-text dumps can be inspected by using + pg_restore's option. + Note that the client running the dump and restore need not trust the + source or destination superusers. -- 2.55.0