diff options
| author | Peter Eisentraut | 2018-07-04 07:26:19 +0000 |
|---|---|---|
| committer | Peter Eisentraut | 2018-07-13 08:41:32 +0000 |
| commit | 3884072329bd1ad7d41bf7582c5d60e969365634 (patch) | |
| tree | da3724960a864d083aab60b66d060f35a9b9ced9 /src/pl | |
| parent | 1f4ec8945967a75f711d721860752985624a0957 (diff) | |
Prohibit transaction commands in security definer procedures
Starting and aborting transactions in security definer procedures
doesn't work. StartTransaction() insists that the security context
stack is empty, so this would currently cause a crash, and
AbortTransaction() resets it. This could be made to work by
reorganizing the code, but right now we just prohibit it.
Reported-by: amul sul <sulamul@gmail.com>
Discussion: https://www.postgresql.org/message-id/flat/CAAJ_b96Gupt_LFL7uNyy3c50-wbhA68NUjiK5%3DrF6_w%3Dpq_T%3DQ%40mail.gmail.com
Diffstat (limited to 'src/pl')
| -rw-r--r-- | src/pl/plpgsql/src/expected/plpgsql_transaction.out | 12 | ||||
| -rw-r--r-- | src/pl/plpgsql/src/sql/plpgsql_transaction.sql | 13 |
2 files changed, 25 insertions, 0 deletions
diff --git a/src/pl/plpgsql/src/expected/plpgsql_transaction.out b/src/pl/plpgsql/src/expected/plpgsql_transaction.out index 274b2c6f17..0b5a039b89 100644 --- a/src/pl/plpgsql/src/expected/plpgsql_transaction.out +++ b/src/pl/plpgsql/src/expected/plpgsql_transaction.out @@ -130,6 +130,18 @@ $$; CALL transaction_test5(); ERROR: invalid transaction termination CONTEXT: PL/pgSQL function transaction_test5() line 3 at COMMIT +-- SECURITY DEFINER currently disallow transaction statements +CREATE PROCEDURE transaction_test5b() +LANGUAGE plpgsql +SECURITY DEFINER +AS $$ +BEGIN + COMMIT; +END; +$$; +CALL transaction_test5b(); +ERROR: invalid transaction termination +CONTEXT: PL/pgSQL function transaction_test5b() line 3 at COMMIT TRUNCATE test1; -- nested procedure calls CREATE PROCEDURE transaction_test6(c text) diff --git a/src/pl/plpgsql/src/sql/plpgsql_transaction.sql b/src/pl/plpgsql/src/sql/plpgsql_transaction.sql index 1624aed6ec..236db9bf2b 100644 --- a/src/pl/plpgsql/src/sql/plpgsql_transaction.sql +++ b/src/pl/plpgsql/src/sql/plpgsql_transaction.sql @@ -116,6 +116,19 @@ $$; CALL transaction_test5(); +-- SECURITY DEFINER currently disallow transaction statements +CREATE PROCEDURE transaction_test5b() +LANGUAGE plpgsql +SECURITY DEFINER +AS $$ +BEGIN + COMMIT; +END; +$$; + +CALL transaction_test5b(); + + TRUNCATE test1; -- nested procedure calls |