Reject non-ON-SELECT rules that are named "_RETURN".

DefineQueryRewrite() has long required that ON SELECT rules be named
"_RETURN".  But we overlooked the converse case: we should forbid
non-ON-SELECT rules that are named "_RETURN".  In particular this
prevents using CREATE OR REPLACE RULE to overwrite a view's _RETURN
rule with some other kind of rule, thereby breaking the view.

Per bug #17646 from Kui Liu.  Back-patch to all supported branches.

Discussion: https://postgr.es/m/17646-70c93cfa40365776@postgresql.org

diff --git a/src/backend/rewrite/rewriteDefine.c b/src/backend/rewrite/rewriteDefine.c
index d218993f61f434db9a8f8f1cfbf0e5d3b142c14e..47a2f2d98f90deeaec9c7de2ff9547b067e6d93a 100644 (file)
--- a/src/backend/rewrite/rewriteDefine.c
+++ b/src/backend/rewrite/rewriteDefine.c
@@ -524,6 +524,18 @@ DefineQueryRewrite(char *rulename,
                                                                RelationGetDescr(event_relation),
                                                                false, false);
                }
+
+               /*
+                * And finally, if it's not an ON SELECT rule then it must *not* be
+                * named _RETURN.  This prevents accidentally or maliciously replacing
+                * a view's ON SELECT rule with some other kind of rule.
+                */
+               if (strcmp(rulename, ViewSelectRuleName) == 0)
+                       ereport(ERROR,
+                                       (errcode(ERRCODE_INVALID_OBJECT_DEFINITION),
+                                        errmsg("non-view rule for \"%s\" must not be named \"%s\"",
+                                                       RelationGetRelationName(event_relation),
+                                                       ViewSelectRuleName)));
        }
 
        /*