From 2355e51110e7c687c125a5958f12a462931de996 Mon Sep 17 00:00:00 2001 From: Dean Rasheed Date: Tue, 14 Jan 2025 13:23:24 +0000 Subject: psql: Add leakproof indicator to \df+, \do+, \dAo+, and \dC+ output. This allows users to determine whether particular functions are leakproof, and whether the underlying functions used by operators and casts are leakproof. This is useful to determine whether indexes can be used in queries on security barrier views or tables with row-level security policies. Yugo Nagata, reviewed by Erik Wienhold and Dean Rasheed. Discussion: https://postgr.es/m/20240701220817.483f9b645b95611f8b1f65da%40sranhm.sraoss.co.jp --- src/bin/psql/describe.c | 54 ++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 42 insertions(+), 12 deletions(-) (limited to 'src/bin') diff --git a/src/bin/psql/describe.c b/src/bin/psql/describe.c index d5543fd62b0..54ebc889c3b 100644 --- a/src/bin/psql/describe.c +++ b/src/bin/psql/describe.c @@ -304,10 +304,10 @@ describeFunctions(const char *functypes, const char *func_pattern, PQExpBufferData buf; PGresult *res; printQueryOpt myopt = pset.popt; - static const bool translate_columns[] = {false, false, false, false, true, true, true, false, true, false, false, false, false}; + static const bool translate_columns[] = {false, false, false, false, true, true, true, false, true, true, false, false, false, false}; /* No "Parallel" column before 9.6 */ - static const bool translate_columns_pre_96[] = {false, false, false, false, true, true, false, true, false, false, false, false}; + static const bool translate_columns_pre_96[] = {false, false, false, false, true, true, false, true, true, false, false, false, false}; if (strlen(functypes) != strspn(functypes, "anptwS+")) { @@ -409,11 +409,15 @@ describeFunctions(const char *functypes, const char *func_pattern, gettext_noop("Parallel")); appendPQExpBuffer(&buf, ",\n pg_catalog.pg_get_userbyid(p.proowner) as \"%s\"" - ",\n CASE WHEN prosecdef THEN '%s' ELSE '%s' END AS \"%s\"", + ",\n CASE WHEN prosecdef THEN '%s' ELSE '%s' END AS \"%s\"" + ",\n CASE WHEN p.proleakproof THEN '%s' ELSE '%s' END as \"%s\"", gettext_noop("Owner"), gettext_noop("definer"), gettext_noop("invoker"), - gettext_noop("Security")); + gettext_noop("Security"), + gettext_noop("yes"), + gettext_noop("no"), + gettext_noop("Leakproof?")); appendPQExpBufferStr(&buf, ",\n "); printACLColumn(&buf, "p.proacl"); appendPQExpBuffer(&buf, @@ -792,6 +796,7 @@ describeOperators(const char *oper_pattern, PQExpBufferData buf; PGresult *res; printQueryOpt myopt = pset.popt; + static const bool translate_columns[] = {false, false, false, false, false, false, true, false}; initPQExpBuffer(&buf); @@ -825,8 +830,12 @@ describeOperators(const char *oper_pattern, if (verbose) appendPQExpBuffer(&buf, - " o.oprcode AS \"%s\",\n", - gettext_noop("Function")); + " o.oprcode AS \"%s\",\n" + " CASE WHEN p.proleakproof THEN '%s' ELSE '%s' END AS \"%s\",\n", + gettext_noop("Function"), + gettext_noop("yes"), + gettext_noop("no"), + gettext_noop("Leakproof?")); appendPQExpBuffer(&buf, " coalesce(pg_catalog.obj_description(o.oid, 'pg_operator'),\n" @@ -851,6 +860,10 @@ describeOperators(const char *oper_pattern, " LEFT JOIN pg_catalog.pg_namespace nt0 ON nt0.oid = t0.typnamespace\n"); } + if (verbose) + appendPQExpBufferStr(&buf, + " LEFT JOIN pg_catalog.pg_proc p ON p.oid = o.oprcode\n"); + if (!showSystem && !oper_pattern) appendPQExpBufferStr(&buf, "WHERE n.nspname <> 'pg_catalog'\n" " AND n.nspname <> 'information_schema'\n"); @@ -908,6 +921,8 @@ describeOperators(const char *oper_pattern, myopt.title = _("List of operators"); myopt.translate_header = true; + myopt.translate_columns = translate_columns; + myopt.n_translate_columns = lengthof(translate_columns); printQuery(res, &myopt, pset.queryFout, false, pset.logfile); @@ -4886,7 +4901,7 @@ listCasts(const char *pattern, bool verbose) PQExpBufferData buf; PGresult *res; printQueryOpt myopt = pset.popt; - static const bool translate_columns[] = {false, false, false, true, false}; + static const bool translate_columns[] = {false, false, false, true, true, false}; initPQExpBuffer(&buf); @@ -4924,7 +4939,13 @@ listCasts(const char *pattern, bool verbose) if (verbose) appendPQExpBuffer(&buf, - ",\n d.description AS \"%s\"", + ",\n CASE WHEN p.proleakproof THEN '%s'\n" + " ELSE '%s'\n" + " END AS \"%s\",\n" + " d.description AS \"%s\"", + gettext_noop("yes"), + gettext_noop("no"), + gettext_noop("Leakproof?"), gettext_noop("Description")); /* @@ -6987,7 +7008,7 @@ listOpFamilyOperators(const char *access_method_pattern, printQueryOpt myopt = pset.popt; bool have_where = false; - static const bool translate_columns[] = {false, false, false, false, false, false}; + static const bool translate_columns[] = {false, false, false, false, false, false, true}; initPQExpBuffer(&buf); @@ -7015,8 +7036,15 @@ listOpFamilyOperators(const char *access_method_pattern, if (verbose) appendPQExpBuffer(&buf, - ", ofs.opfname AS \"%s\"\n", - gettext_noop("Sort opfamily")); + ", ofs.opfname AS \"%s\",\n" + " CASE\n" + " WHEN p.proleakproof THEN '%s'\n" + " ELSE '%s'\n" + " END AS \"%s\"\n", + gettext_noop("Sort opfamily"), + gettext_noop("yes"), + gettext_noop("no"), + gettext_noop("Leakproof?")); appendPQExpBufferStr(&buf, "FROM pg_catalog.pg_amop o\n" " LEFT JOIN pg_catalog.pg_opfamily of ON of.oid = o.amopfamily\n" @@ -7024,7 +7052,9 @@ listOpFamilyOperators(const char *access_method_pattern, " LEFT JOIN pg_catalog.pg_namespace nsf ON of.opfnamespace = nsf.oid\n"); if (verbose) appendPQExpBufferStr(&buf, - " LEFT JOIN pg_catalog.pg_opfamily ofs ON ofs.oid = o.amopsortfamily\n"); + " LEFT JOIN pg_catalog.pg_opfamily ofs ON ofs.oid = o.amopsortfamily\n" + " LEFT JOIN pg_catalog.pg_operator op ON op.oid = o.amopopr\n" + " LEFT JOIN pg_catalog.pg_proc p ON p.oid = op.oprcode\n"); if (access_method_pattern) { -- cgit v1.2.3