• Stephen Frost's avatar
    Reset plan->row_security_env and planUserId · 86ebf30f
    Stephen Frost authored
    In the plancache, we check if the environment we planned the query under
    has changed in a way which requires us to re-plan, such as when the user
    for whom the plan was prepared changes and RLS is being used (and,
    therefore, there may be different policies to apply).
    
    Unfortunately, while those values were set and checked, they were not
    being reset when the query was re-planned and therefore, in cases where
    we change role, re-plan, and then change role again, we weren't
    re-planning again.  This leads to potentially incorrect policies being
    applied in cases where role-specific policies are used and a given query
    is planned under one role and then executed under other roles, which
    could happen under security definer functions or when a common user and
    query is planned initially and then re-used across multiple SET ROLEs.
    
    Further, extensions which made use of CopyCachedPlan() may suffer from
    similar issues as the RLS-related fields were not properly copied as
    part of the plan and therefore RevalidateCachedQuery() would copy in the
    current settings without invalidating the query.
    
    Fix by using the same approach used for 'search_path', where we set the
    correct values in CompleteCachedPlan(), check them early on in
    RevalidateCachedQuery() and then properly reset them if re-planning.
    Also, copy through the values during CopyCachedPlan().
    
    Pointed out by Ashutosh Bapat.  Reviewed by Michael Paquier.
    
    Back-patch to 9.5 where RLS was introduced.
    
    Security: CVE-2016-2193
    86ebf30f
plancache.c 61.9 KB