Ignore attempts to \gset into specially treated variables.

If an interactive psql session used \gset when querying a compromised
server, the attacker could execute arbitrary code as the operating
system account running psql.  Using a prefix not found among specially
treated variables, e.g. every lowercase string, precluded the attack.
Fix by issuing a warning and setting no variable for the column in
question.  Users wanting the old behavior can use a prefix and then a
meta-command like "\set HISTSIZE :prefix_HISTSIZE".  Back-patch to 9.5
(all supported versions).

Reviewed by Robert Haas.  Reported by Nick Cleaton.

Security: CVE-2020-25696

diff --git a/src/bin/psql/common.c b/src/bin/psql/common.c
index bc955990a140ab896306d02757c615ed249ad580..e0bee8fc97bf093e089a9222a7bc6feea4a63113 100644 (file)
--- a/src/bin/psql/common.c
+++ b/src/bin/psql/common.c
@@ -708,6 +708,13 @@ StoreQueryTuple(const PGresult *result)
                        /* concatenate prefix and column name */
                        varname = psprintf("%s%s", pset.gset_prefix, colname);
 
+                       if (VariableHasHook(pset.vars, varname))
+                       {
+                               psql_error("attempt to \\gset into specially treated variable \"%s\" ignored\n",
+                                                  varname);
+                               continue;
+                       }
+
                        if (!PQgetisnull(result, 0, i))
                                value = PQgetvalue(result, 0, i);
                        else

diff --git a/src/bin/psql/variables.c b/src/bin/psql/variables.c
index b9a3dfad3316ec0875c4b15d46e917f71c354beb..03d218ea129b884a9312422abf90d0d340e9cda3 100644 (file)
--- a/src/bin/psql/variables.c
+++ b/src/bin/psql/variables.c
@@ -264,6 +264,24 @@ SetVariableAssignHook(VariableSpace space, const char *name, VariableAssignHook
        return true;
 }
 
+/*
+ * Return true iff the named variable has an assign hook function.
+ */
+bool
+VariableHasHook(VariableSpace space, const char *name)
+{
+       struct _variable *current;
+
+       Assert(space);
+       Assert(name);
+
+       for (current = space->next; current; current = current->next)
+               if (strcmp(current->name, name) == 0)
+                       return current->assign_hook != NULL;
+
+       return false;
+}
+
 bool
 SetVariableBool(VariableSpace space, const char *name)
 {

diff --git a/src/bin/psql/variables.h b/src/bin/psql/variables.h
index c071846d9ff3bdc9055686be9dab42405e5ec5aa..fba4af0c811d0b21cce23289f6d42efc00919dcd 100644 (file)
--- a/src/bin/psql/variables.h
+++ b/src/bin/psql/variables.h
@@ -50,6 +50,7 @@ void          PrintVariables(VariableSpace space);
 
 bool           SetVariable(VariableSpace space, const char *name, const char *value);
 bool           SetVariableAssignHook(VariableSpace space, const char *name, VariableAssignHook hook);
+bool           VariableHasHook(VariableSpace space, const char *name);
 bool           SetVariableBool(VariableSpace space, const char *name);
 bool           DeleteVariable(VariableSpace space, const char *name);
 

diff --git a/src/test/regress/expected/psql.out b/src/test/regress/expected/psql.out
index b625dd34406fd85d0b766fa2d63d1eda4a1e8d76..125831a07f1c587ac4453bf5a4cdc225ef0c62e9 100644 (file)
--- a/src/test/regress/expected/psql.out
+++ b/src/test/regress/expected/psql.out
@@ -10,6 +10,10 @@ select 10 as test01, 20 as test02, 'Hello' as test03 \gset pref01_
 select 10 as "bad name"
 \gset
 could not set variable "bad name"
+select 'terse' as "OSITY", 'ok' as _foo \gset VERB
+attempt to \gset into specially treated variable "VERBOSITY" ignored
+\echo :VERB_foo :VERBOSITY
+ok default
 -- multiple backslash commands in one line
 select 1 as x, 2 as y \gset pref01_ \\ \echo :pref01_x
 1

diff --git a/src/test/regress/sql/psql.sql b/src/test/regress/sql/psql.sql
index 84097bdaa30ae7d1e244046888925851df5b877e..db27f9d9c9ea57f34add12722327fe24a5ca99d4 100644 (file)
--- a/src/test/regress/sql/psql.sql
+++ b/src/test/regress/sql/psql.sql
@@ -13,6 +13,9 @@ select 10 as test01, 20 as test02, 'Hello' as test03 \gset pref01_
 select 10 as "bad name"
 \gset
 
+select 'terse' as "OSITY", 'ok' as _foo \gset VERB
+\echo :VERB_foo :VERBOSITY
+
 -- multiple backslash commands in one line
 select 1 as x, 2 as y \gset pref01_ \\ \echo :pref01_x
 select 3 as x, 4 as y \gset pref01_ \echo :pref01_x \echo :pref01_y