Re: CVE-2017-7484-induced bugs, or, btree cmp functions are notleakproof?

Поиск
Список
Период
Сортировка
От Peter Eisentraut
Тема Re: CVE-2017-7484-induced bugs, or, btree cmp functions are notleakproof?
Дата
Msg-id 3ad75dc5-4ae7-087a-f2f8-b3bd92a8b2b0@2ndquadrant.com
обсуждение исходный текст
Ответ на Re: CVE-2017-7484-induced bugs, or, btree cmp functions are not leakproof?  (Tom Lane <tgl@sss.pgh.pa.us>)
Ответы Re: CVE-2017-7484-induced bugs, or, btree cmp functions are not leakproof?  (Tom Lane <tgl@sss.pgh.pa.us>)
Список pgsql-hackers
On 12.07.18 00:52, Tom Lane wrote:
>> Another question that could be raised is why we are refusing to use
>> stats for a child table when the caller has select on the parent.
>> It's completely trivial to extract data from a child table if you
>> have select on the parent, so it seems like we are checking the
>> wrong table's privileges.

That seems like an oversight.

The underlying principle is that we want to allow access to statistics
if the user could read the table, or more accurately the column, anyway.
 This could also happen through inheritance, so we should check that as
well, but we need to make sure that the particular column is inherited
and not added locally.  Also, for the expression index case, we don't
track the individual columns, so we don't have that information.  For
partitioning, we can rely on all the columns being inherited, but not
for plain inheritance.  So there are some details to work through, it seems.

-- 
Peter Eisentraut              http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services


В списке pgsql-hackers по дате отправления:

Предыдущее
От: Peter Eisentraut
Дата:
Сообщение: Re: make installcheck-world in a clean environment
Следующее
От: Peter Eisentraut
Дата:
Сообщение: Re: Segfault logical replication PG 10.4