mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-08-28 01:07:20 +02:00
The two methods don't cooperate, so set_config_option("search_path", ...) has been ineffective under non-empty overrideStack. This defect enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. While that particular attack requires v13+ for the trusted extension attribute, other attacks are feasible in all supported versions. Standardize on the combination of NewGUCNestLevel() and set_config_option("search_path", ...). It is newer than PushOverrideSearchPath(), more-prevalent, and has no known disadvantages. The "override" mechanism remains for now, for compatibility with out-of-tree code. Users should update such code, which likely suffers from the same sort of vulnerability closed here. Back-patch to v11 (all supported versions). Alexander Lakhin. Reported by Alexander Lakhin. Security: CVE-2023-2454
46 lines
904 B
Makefile
46 lines
904 B
Makefile
# contrib/seg/Makefile
|
|
|
|
MODULE_big = seg
|
|
OBJS = \
|
|
$(WIN32RES) \
|
|
seg.o \
|
|
segparse.o \
|
|
segscan.o
|
|
|
|
EXTENSION = seg
|
|
DATA = seg--1.1.sql seg--1.1--1.2.sql seg--1.2--1.3.sql seg--1.3--1.4.sql \
|
|
seg--1.0--1.1.sql
|
|
PGFILEDESC = "seg - line segment data type"
|
|
|
|
HEADERS = segdata.h
|
|
|
|
REGRESS = security seg
|
|
|
|
EXTRA_CLEAN = y.tab.c y.tab.h
|
|
|
|
ifdef USE_PGXS
|
|
PG_CONFIG = pg_config
|
|
PGXS := $(shell $(PG_CONFIG) --pgxs)
|
|
include $(PGXS)
|
|
else
|
|
subdir = contrib/seg
|
|
top_builddir = ../..
|
|
include $(top_builddir)/src/Makefile.global
|
|
include $(top_srcdir)/contrib/contrib-global.mk
|
|
endif
|
|
|
|
|
|
# See notes in src/backend/parser/Makefile about the following two rules
|
|
segparse.h: segparse.c
|
|
touch $@
|
|
|
|
segparse.c: BISONFLAGS += -d
|
|
|
|
# Force these dependencies to be known even without dependency info built:
|
|
segparse.o segscan.o: segparse.h
|
|
|
|
distprep: segparse.c segscan.c
|
|
|
|
maintainer-clean:
|
|
rm -f segparse.h segparse.c segscan.c
|