diff --git a/contrib/seg/Makefile b/contrib/seg/Makefile index bb63e835067..aee8826d8be 100644 --- a/contrib/seg/Makefile +++ b/contrib/seg/Makefile @@ -13,7 +13,7 @@ PGFILEDESC = "seg - line segment data type" HEADERS = segdata.h -REGRESS = seg +REGRESS = security seg EXTRA_CLEAN = y.tab.c y.tab.h diff --git a/contrib/seg/expected/security.out b/contrib/seg/expected/security.out new file mode 100644 index 00000000000..b47598d0392 --- /dev/null +++ b/contrib/seg/expected/security.out @@ -0,0 +1,32 @@ +-- +-- Test extension script protection against search path overriding +-- +CREATE ROLE regress_seg_role; +SELECT current_database() AS datname \gset +GRANT CREATE ON DATABASE :"datname" TO regress_seg_role; +SET ROLE regress_seg_role; +CREATE SCHEMA regress_seg_schema; +CREATE FUNCTION regress_seg_schema.exfun(i int) RETURNS int AS $$ +BEGIN + CREATE EXTENSION seg VERSION '1.2'; + + CREATE FUNCTION regress_seg_schema.compare(oid, regclass) RETURNS boolean AS + 'BEGIN RAISE EXCEPTION ''overloaded compare() called by %'', current_user; END;' LANGUAGE plpgsql; + + CREATE OPERATOR = (LEFTARG = oid, RIGHTARG = regclass, PROCEDURE = regress_seg_schema.compare); + + ALTER EXTENSION seg UPDATE TO '1.3'; + + RETURN i; +END; $$ LANGUAGE plpgsql; +CREATE SCHEMA test_schema +CREATE TABLE t(i int) PARTITION BY RANGE (i) +CREATE TABLE p1 PARTITION OF t FOR VALUES FROM (1) TO (regress_seg_schema.exfun(2)); +DROP SCHEMA test_schema CASCADE; +NOTICE: drop cascades to 3 other objects +DETAIL: drop cascades to table test_schema.t +drop cascades to extension seg +drop cascades to operator test_schema.=(oid,regclass) +RESET ROLE; +DROP OWNED BY regress_seg_role; +DROP ROLE regress_seg_role; diff --git a/contrib/seg/sql/security.sql b/contrib/seg/sql/security.sql new file mode 100644 index 00000000000..7dfbbaa304a --- /dev/null +++ b/contrib/seg/sql/security.sql @@ -0,0 +1,32 @@ +-- +-- Test extension script protection against search path overriding +-- + +CREATE ROLE regress_seg_role; +SELECT current_database() AS datname \gset +GRANT CREATE ON DATABASE :"datname" TO regress_seg_role; +SET ROLE regress_seg_role; +CREATE SCHEMA regress_seg_schema; + +CREATE FUNCTION regress_seg_schema.exfun(i int) RETURNS int AS $$ +BEGIN + CREATE EXTENSION seg VERSION '1.2'; + + CREATE FUNCTION regress_seg_schema.compare(oid, regclass) RETURNS boolean AS + 'BEGIN RAISE EXCEPTION ''overloaded compare() called by %'', current_user; END;' LANGUAGE plpgsql; + + CREATE OPERATOR = (LEFTARG = oid, RIGHTARG = regclass, PROCEDURE = regress_seg_schema.compare); + + ALTER EXTENSION seg UPDATE TO '1.3'; + + RETURN i; +END; $$ LANGUAGE plpgsql; + +CREATE SCHEMA test_schema +CREATE TABLE t(i int) PARTITION BY RANGE (i) +CREATE TABLE p1 PARTITION OF t FOR VALUES FROM (1) TO (regress_seg_schema.exfun(2)); + +DROP SCHEMA test_schema CASCADE; +RESET ROLE; +DROP OWNED BY regress_seg_role; +DROP ROLE regress_seg_role; diff --git a/src/test/regress/sql/namespace.sql b/src/test/regress/sql/namespace.sql index 2879672d786..e4aa9f15f58 100644 --- a/src/test/regress/sql/namespace.sql +++ b/src/test/regress/sql/namespace.sql @@ -37,6 +37,26 @@ COMMIT; SHOW search_path; DROP SCHEMA test_ns_schema_2 CASCADE; +-- verify that the correct search_path restored on abort +SET search_path to public; +BEGIN; +SET search_path to public, test_ns_schema_1; +CREATE SCHEMA test_ns_schema_2 + CREATE VIEW abc_view AS SELECT c FROM abc; +COMMIT; +SHOW search_path; + +-- verify that the correct search_path preserved +-- after creating the schema and on commit +BEGIN; +SET search_path to public, test_ns_schema_1; +CREATE SCHEMA test_ns_schema_2 + CREATE VIEW abc_view AS SELECT a FROM abc; +SHOW search_path; +COMMIT; +SHOW search_path; +DROP SCHEMA test_ns_schema_2 CASCADE; + -- verify that the objects were created SELECT COUNT(*) FROM pg_class WHERE relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = 'test_ns_schema_1');