From caa165f50aefaa30ba4e29b4b959ddb4e49ba9d6 Mon Sep 17 00:00:00 2001
From: Zsolt Parragi <zsolt.parragi@percona.com>
Date: Sat, 10 Oct 2026 09:04:57 +0000
Subject: [PATCH v1] oauth_validator: Reject empty library names

bca67e5a3 rejected an oauth_validator_libraries setting that parses as
an empty list, but a quoted empty element ('""') still got through,
leaving the HBA line with an empty validator name. Logins on that line
then crash or fail.

Reject empty elements during HBA parsing.

Backpatch-through: 18
---
 src/backend/libpq/auth-oauth.c                   | 16 ++++++++++++++++
 src/test/modules/oauth_validator/t/001_server.pl |  8 ++++++++
 2 files changed, 24 insertions(+)

diff --git a/src/backend/libpq/auth-oauth.c b/src/backend/libpq/auth-oauth.c
index fb830065fba..fe4b842ea40 100644
--- a/src/backend/libpq/auth-oauth.c
+++ b/src/backend/libpq/auth-oauth.c
@@ -892,6 +892,22 @@ check_oauth_validator(HbaLine *hbaline, int elevel, char **err_msg)
 		goto done;
 	}
 
+	foreach_ptr(char, allowed, elemlist)
+	{
+		if (allowed[0] == '\0')
+		{
+			ereport(elevel,
+					errcode(ERRCODE_CONFIG_FILE_ERROR),
+					errmsg("invalid list syntax in parameter \"%s\"",
+						   "oauth_validator_libraries"),
+					errcontext("line %d of configuration file \"%s\"",
+							   line_num, file_name));
+			*err_msg = psprintf("invalid list syntax in parameter \"%s\"",
+								"oauth_validator_libraries");
+			goto done;
+		}
+	}
+
 	if (!hbaline->oauth_validator)
 	{
 		if (elemlist->length == 1)
diff --git a/src/test/modules/oauth_validator/t/001_server.pl b/src/test/modules/oauth_validator/t/001_server.pl
index 444de01ea5d..f374070284a 100644
--- a/src/test/modules/oauth_validator/t/001_server.pl
+++ b/src/test/modules/oauth_validator/t/001_server.pl
@@ -143,6 +143,14 @@ $log_start = $node->wait_for_log(
 	$log_start);
 $bgconn->query_safe('SELECT 1');
 
+# A quoted empty name survives list parsing; it must be rejected as well.
+$node->append_conf('postgresql.conf', "oauth_validator_libraries = '\"\"'");
+$node->reload;
+$log_start = $node->wait_for_log(
+	qr/invalid list syntax in parameter "oauth_validator_libraries"/,
+	$log_start);
+$bgconn->query_safe('SELECT 1');
+
 $node->append_conf('postgresql.conf',
 	"oauth_validator_libraries = 'validator'");
 $node->reload;
-- 
2.55.0