Disable the undocumented xmlvalidate() function, which was unintentionally

left in the code though it was not meant to be provided.  It represents a
security hole because unprivileged users could use it to look at (at least the
first line of) any file readable by the backend.  Fortunately, this is only
possible if the backend was built with XML support, so the damage is at least
mitigated; and 8.3 probably hasn't propagated into any security-critical uses
yet anyway.  Per report from Sergey Burladyan.

diff --git a/src/backend/utils/adt/xml.c b/src/backend/utils/adt/xml.c
index 3659691a4bc74726e11c91b4f7d2ab759aa724d8..736f4634d5a55096efe0a95433c8d8f4444fccd6 100644 (file)
--- a/src/backend/utils/adt/xml.c
+++ b/src/backend/utils/adt/xml.c
@@ -788,70 +788,19 @@ xmlroot(xmltype *data, text *version, int standalone)
 
 /*
  * Validate document (given as string) against DTD (given as external link)
- * TODO !!! use text instead of cstring for second arg
- * TODO allow passing DTD as a string value (not only as an URI)
- * TODO redesign (see comment with '!!!' below)
+ *
+ * This has been removed because it is a security hole: unprivileged users
+ * should not be able to use Postgres to fetch arbitrary external files,
+ * which unfortunately is exactly what libxml is willing to do with the DTD
+ * parameter.
  */
 Datum
 xmlvalidate(PG_FUNCTION_ARGS)
 {
-#ifdef USE_LIBXML
-       text       *data = PG_GETARG_TEXT_P(0);
-       text       *dtdOrUri = PG_GETARG_TEXT_P(1);
-       bool            result = false;
-       xmlParserCtxtPtr ctxt;
-       xmlDocPtr       doc;
-       xmlDtdPtr       dtd;
-
-       xml_init();
-       xmlInitParser();
-       ctxt = xmlNewParserCtxt();
-       if (ctxt == NULL)
-               xml_ereport(ERROR, ERRCODE_OUT_OF_MEMORY,
-                                       "could not allocate parser context");
-
-       doc = xmlCtxtReadMemory(ctxt, (char *) VARDATA(data),
-                                                       VARSIZE(data) - VARHDRSZ,
-                                                       NULL, NULL, 0);
-       if (doc == NULL)
-               xml_ereport(ERROR, ERRCODE_INVALID_XML_DOCUMENT,
-                                       "could not parse XML data");
-
-#if 0
-       uri = xmlCreateURI();
-       elog(NOTICE, "dtd - %s", dtdOrUri);
-       dtd = palloc(sizeof(xmlDtdPtr));
-       uri = xmlParseURI(dtdOrUri);
-       if (uri == NULL)
-               xml_ereport(ERROR, ERRCODE_INTERNAL_ERROR,
-                                       "not implemented yet... (TODO)");
-       else
-#endif
-               dtd = xmlParseDTD(NULL, xml_text2xmlChar(dtdOrUri));
-
-       if (dtd == NULL)
-               xml_ereport(ERROR, ERRCODE_INVALID_XML_DOCUMENT,
-                                       "could not load DTD");
-
-       if (xmlValidateDtd(xmlNewValidCtxt(), doc, dtd) == 1)
-               result = true;
-
-       if (!result)
-               xml_ereport(NOTICE, ERRCODE_INVALID_XML_DOCUMENT,
-                                       "validation against DTD failed");
-
-#if 0
-       xmlFreeURI(uri);
-#endif
-       xmlFreeDtd(dtd);
-       xmlFreeDoc(doc);
-       xmlFreeParserCtxt(ctxt);
-
-       PG_RETURN_BOOL(result);
-#else                                                  /* not USE_LIBXML */
-       NO_XML_SUPPORT();
+       ereport(ERROR,
+                       (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+                        errmsg("xmlvalidate is not implemented")));
        return 0;
-#endif   /* not USE_LIBXML */
 }