Use schema qualification for internal queries.

Some of objects such as function and cast did not use "pg_catalog."
schema qualification.  This does not lead to immediate security
concern but using the schema qualification is always good practice.

Not that for this I had to increase some buffer length:

- POOL_RELCACHE.query was changed from 1024 to 1500.
- query buffer size in pool_search_relcache was changed from 1024 to 1500.

Back patch to all supported branches: 4.4 to 4.0

diff --git a/src/include/utils/pool_relcache.h b/src/include/utils/pool_relcache.h
index d4a367857c5057d4f08319639b1ad3e40e134b11..70b7d3143b6651d64c4e23588da3e0c772c64825 100644 (file)
--- a/src/include/utils/pool_relcache.h
+++ b/src/include/utils/pool_relcache.h
@@ -46,10 +46,11 @@ typedef struct
        time_t          expire;                 /* cache expiration absolute time in seconds */
 }                      PoolRelCache;
 
+#define        MAX_QUERY_LENGTH        1500
 typedef struct
 {
        int                     num;                    /* number of cache items */
-       char            sql[MAX_ITEM_LENGTH];   /* Query to relation */
+       char            sql[MAX_QUERY_LENGTH];  /* Query to relation */
 
        /*
         * User defined function to be called at data register. Argument is

diff --git a/src/query_cache/pool_memqcache.c b/src/query_cache/pool_memqcache.c
index 4c2208bb3157ed5f7b0bfff558ed31ed6a5aa848..89510f73ee05cd398962d885bda9bac630274830 100644 (file)
--- a/src/query_cache/pool_memqcache.c
+++ b/src/query_cache/pool_memqcache.c
@@ -19,7 +19,7 @@
  * pool_memqcache.c: query cache on shmem or memcached
  *
  */
-#define DATABASE_TO_OID_QUERY "SELECT oid FROM pg_database WHERE datname = '%s'"
+#define DATABASE_TO_OID_QUERY "SELECT oid FROM pg_catalog.pg_database WHERE datname = '%s'"
 
 #include "pool.h"
 

diff --git a/src/rewrite/pool_timestamp.c b/src/rewrite/pool_timestamp.c
index cc7e8c5b77d21203929010f36e5e035e90332b00..7a526d21abea356f53fc89e53552fe72966c97b9 100644 (file)
--- a/src/rewrite/pool_timestamp.c
+++ b/src/rewrite/pool_timestamp.c
@@ -5,7 +5,7 @@
  * pgpool: a language independent connection pool server for PostgreSQL
  * written by Tatsuo Ishii
  *
- * Copyright (c) 2003-2016     PgPool Global Development Group
+ * Copyright (c) 2003-2023     PgPool Global Development Group
  *
  * Permission to use, copy, modify, and distribute this software and
  * its documentation for any purpose and without fee is hereby
@@ -139,14 +139,14 @@ static TSRel *
 relcache_lookup(TSRewriteContext * ctx)
 {
 #define ATTRDEFQUERY (Pgversion(ctx->backend)->major >= 73 ? \
-       "SELECT attname, pg_get_expr(d.adbin, d.adrelid), coalesce((pg_get_expr(d.adbin, d.adrelid) LIKE '%%now()%%' OR pg_get_expr(d.adbin, d.adrelid) LIKE '%%''now''::text%%' OR" \
-       " pg_get_expr(d.adbin, d.adrelid) LIKE '%%CURRENT_TIMESTAMP%%' OR pg_get_expr(d.adbin, d.adrelid) LIKE '%%CURRENT_TIME%%' OR pg_get_expr(d.adbin, d.adrelid) LIKE '%%CURRENT_DATE%%' OR" \
-       " pg_get_expr(d.adbin, d.adrelid) LIKE '%%LOCALTIME%%' OR pg_get_expr(d.adbin, d.adrelid) LIKE '%%LOCALTIMESTAMP%%')" \
-       " AND (a.atttypid = 'timestamp'::regtype::oid OR" \
-       " a.atttypid = 'timestamp with time zone'::regtype::oid OR" \
-       " a.atttypid = 'date'::regtype::oid OR" \
-       " a.atttypid = 'time'::regtype::oid OR" \
-       " a.atttypid = 'time with time zone'::regtype::oid)" \
+       "SELECT attname, pg_catalog.pg_get_expr(d.adbin, d.adrelid), coalesce((pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%now()%%' OR pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%''now''::text%%' OR" \
+       " pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%CURRENT_TIMESTAMP%%' OR pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%CURRENT_TIME%%' OR pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%CURRENT_DATE%%' OR" \
+       " pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%LOCALTIME%%' OR pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%LOCALTIMESTAMP%%')" \
+       " AND (a.atttypid = 'timestamp'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'timestamp with time zone'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'date'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'time'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'time with time zone'::pg_catalog.regtype::pg_catalog.oid)" \
     " , false)" \
        " FROM pg_catalog.pg_class c, pg_catalog.pg_attribute a " \
        " LEFT JOIN pg_catalog.pg_attrdef d ON (a.attrelid = d.adrelid AND a.attnum = d.adnum)" \
@@ -155,11 +155,11 @@ relcache_lookup(TSRewriteContext * ctx)
        "SELECT attname, d.adsrc, coalesce((d.adsrc LIKE '%%now()%%' OR d.adsrc LIKE '%%''now''::text%%' OR" \
        " d.adsrc LIKE '%%CURRENT_TIMESTAMP%%' OR d.adsrc LIKE '%%CURRENT_TIME%%' OR d.adsrc LIKE '%%CURRENT_DATE%%' OR" \
        " d.adsrc LIKE '%%LOCALTIME%%' OR d.adsrc LIKE '%%LOCALTIMESTAMP%%')" \
-       " AND (a.atttypid = 'timestamp'::regtype::oid OR" \
-       " a.atttypid = 'timestamp with time zone'::regtype::oid OR" \
-       " a.atttypid = 'date'::regtype::oid OR" \
-       " a.atttypid = 'time'::regtype::oid OR" \
-       " a.atttypid = 'time with time zone'::regtype::oid)" \
+       " AND (a.atttypid = 'timestamp'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'timestamp with time zone'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'date'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'time'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'time with time zone'::pg_catalog.regtype::pg_catalog.oid)" \
     " , false)" \
        " FROM pg_catalog.pg_class c, pg_catalog.pg_attribute a " \
        " LEFT JOIN pg_catalog.pg_attrdef d ON (a.attrelid = d.adrelid AND a.attnum = d.adnum)" \
@@ -167,14 +167,14 @@ relcache_lookup(TSRewriteContext * ctx)
        " ORDER BY a.attnum")
 
 #define ATTRDEFQUERY2 (Pgversion(ctx->backend)->major >= 73 ? \
-       "SELECT attname, pg_get_expr(d.adbin, d.adrelid), coalesce((pg_get_expr(d.adbin, d.adrelid) LIKE '%%now()%%' OR pg_get_expr(d.adbin, d.adrelid) LIKE '%%''now''::text%%' OR" \
-       " pg_get_expr(d.adbin, d.adrelid) LIKE '%%CURRENT_TIMESTAMP%%' OR pg_get_expr(d.adbin, d.adrelid) LIKE '%%CURRENT_TIME%%' OR pg_get_expr(d.adbin, d.adrelid) LIKE '%%CURRENT_DATE%%' OR" \
-       " pg_get_expr(d.adbin, d.adrelid) LIKE '%%LOCALTIME%%' OR pg_get_expr(d.adbin, d.adrelid) LIKE '%%LOCALTIMESTAMP%%')" \
-       " AND (a.atttypid = 'timestamp'::regtype::oid OR" \
-       " a.atttypid = 'timestamp with time zone'::regtype::oid OR" \
-       " a.atttypid = 'date'::regtype::oid OR" \
-       " a.atttypid = 'time'::regtype::oid OR" \
-       " a.atttypid = 'time with time zone'::regtype::oid)" \
+       "SELECT attname, pg_catalog.pg_get_expr(d.adbin, d.adrelid), coalesce((pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%now()%%' OR pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%''now''::text%%' OR" \
+       " pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%CURRENT_TIMESTAMP%%' OR pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%CURRENT_TIME%%' OR pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%CURRENT_DATE%%' OR" \
+       " pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%LOCALTIME%%' OR pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%LOCALTIMESTAMP%%')" \
+       " AND (a.atttypid = 'timestamp'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'timestamp with time zone'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'date'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'time'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'time with time zone'::pg_catalog.regtype::pg_catalog.oid)" \
     " , false)" \
        " FROM pg_catalog.pg_class c, pg_catalog.pg_attribute a " \
        " LEFT JOIN pg_catalog.pg_attrdef d ON (a.attrelid = d.adrelid AND a.attnum = d.adnum)" \
@@ -183,11 +183,11 @@ relcache_lookup(TSRewriteContext * ctx)
        "SELECT attname, d.adsrc, coalesce((d.adsrc LIKE '%%now()%%' OR d.adsrc LIKE '%%''now''::text%%' OR" \
        " d.adsrc LIKE '%%CURRENT_TIMESTAMP%%' OR d.adsrc LIKE '%%CURRENT_TIME%%' OR d.adsrc LIKE '%%CURRENT_DATE%%' OR" \
        " d.adsrc LIKE '%%LOCALTIME%%' OR d.adsrc LIKE '%%LOCALTIMESTAMP%%')" \
-       " AND (a.atttypid = 'timestamp'::regtype::oid OR" \
-       " a.atttypid = 'timestamp with time zone'::regtype::oid OR" \
-       " a.atttypid = 'date'::regtype::oid OR" \
-       " a.atttypid = 'time'::regtype::oid OR" \
-       " a.atttypid = 'time with time zone'::regtype::oid)" \
+       " AND (a.atttypid = 'timestamp'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'timestamp with time zone'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'date'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'time'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'time with time zone'::pg_catalog.regtype::pg_catalog.oid)" \
     " , false)" \
        " FROM pg_catalog.pg_class c, pg_catalog.pg_attribute a " \
        " LEFT JOIN pg_catalog.pg_attrdef d ON (a.attrelid = d.adrelid AND a.attnum = d.adnum)" \
@@ -195,31 +195,31 @@ relcache_lookup(TSRewriteContext * ctx)
        " ORDER BY a.attnum")
 
 #define ATTRDEFQUERY3 (Pgversion(ctx->backend)->major >= 73 ? \
-       "SELECT attname, pg_get_expr(d.adbin, d.adrelid), coalesce((pg_get_expr(d.adbin, d.adrelid) LIKE '%%now()%%' OR pg_get_expr(d.adbin, d.adrelid) LIKE '%%''now''::text%%' OR" \
-       " pg_get_expr(d.adbin, d.adrelid) LIKE '%%CURRENT_TIMESTAMP%%' OR pg_get_expr(d.adbin, d.adrelid) LIKE '%%CURRENT_TIME%%' OR pg_get_expr(d.adbin, d.adrelid) LIKE '%%CURRENT_DATE%%' OR" \
-       " pg_get_expr(d.adbin, d.adrelid) LIKE '%%LOCALTIME%%' OR pg_get_expr(d.adbin, d.adrelid) LIKE '%%LOCALTIMESTAMP%%')" \
-       " AND (a.atttypid = 'timestamp'::regtype::oid OR" \
-       " a.atttypid = 'timestamp with time zone'::regtype::oid OR" \
-       " a.atttypid = 'date'::regtype::oid OR" \
-       " a.atttypid = 'time'::regtype::oid OR" \
-       " a.atttypid = 'time with time zone'::regtype::oid)" \
+       "SELECT attname, pg_catalog.pg_get_expr(d.adbin, d.adrelid), coalesce((pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%now()%%' OR pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%''now''::text%%' OR" \
+       " pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%CURRENT_TIMESTAMP%%' OR pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%CURRENT_TIME%%' OR pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%CURRENT_DATE%%' OR" \
+       " pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%LOCALTIME%%' OR pg_catalog.pg_get_expr(d.adbin, d.adrelid) LIKE '%%LOCALTIMESTAMP%%')" \
+       " AND (a.atttypid = 'timestamp'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'timestamp with time zone'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'date'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'time'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'time with time zone'::pg_catalog.regtype::pg_catalog.oid)" \
     " , false)" \
        " FROM pg_catalog.pg_class c, pg_catalog.pg_attribute a " \
        " LEFT JOIN pg_catalog.pg_attrdef d ON (a.attrelid = d.adrelid AND a.attnum = d.adnum)" \
-       " WHERE c.oid = a.attrelid AND a.attnum >= 1 AND a.attisdropped = 'f' AND c.oid = to_regclass('%s')" \
+       " WHERE c.oid = a.attrelid AND a.attnum >= 1 AND a.attisdropped = 'f' AND c.oid = pg_catalog.to_regclass('%s')" \
        " ORDER BY a.attnum" : \
        "SELECT attname, d.adsrc, coalesce((d.adsrc LIKE '%%now()%%' OR d.adsrc LIKE '%%''now''::text%%' OR" \
        " d.adsrc LIKE '%%CURRENT_TIMESTAMP%%' OR d.adsrc LIKE '%%CURRENT_TIME%%' OR d.adsrc LIKE '%%CURRENT_DATE%%' OR" \
        " d.adsrc LIKE '%%LOCALTIME%%' OR d.adsrc LIKE '%%LOCALTIMESTAMP%%')" \
-       " AND (a.atttypid = 'timestamp'::regtype::oid OR" \
-       " a.atttypid = 'timestamp with time zone'::regtype::oid OR" \
-       " a.atttypid = 'date'::regtype::oid OR" \
-       " a.atttypid = 'time'::regtype::oid OR" \
-       " a.atttypid = 'time with time zone'::regtype::oid)" \
+       " AND (a.atttypid = 'timestamp'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'timestamp with time zone'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'date'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'time'::pg_catalog.regtype::pg_catalog.oid OR" \
+       " a.atttypid = 'time with time zone'::pg_catalog.regtype::pg_catalog.oid)" \
     " , false)" \
        " FROM pg_catalog.pg_class c, pg_catalog.pg_attribute a " \
        " LEFT JOIN pg_catalog.pg_attrdef d ON (a.attrelid = d.adrelid AND a.attnum = d.adnum)" \
-       " WHERE c.oid = a.attrelid AND a.attnum >= 1 AND a.attisdropped = 'f' AND c.oid = to_regclass('%s')" \
+       " WHERE c.oid = a.attrelid AND a.attnum >= 1 AND a.attisdropped = 'f' AND c.oid = pg_catalog.to_regclass('%s')" \
        " ORDER BY a.attnum")
 
        char       *query;
@@ -488,7 +488,7 @@ get_current_timestamp(POOL_CONNECTION_POOL * backend)
        POOL_SELECT_RESULT *res;
        static char timestamp[64];
 
-       do_query(MAIN(backend), "SELECT now()", &res, MAJOR(backend));
+       do_query(MAIN(backend), "SELECT pg_catalog.now()", &res, MAJOR(backend));
 
        if (res->numrows != 1)
        {

diff --git a/src/utils/pool_relcache.c b/src/utils/pool_relcache.c
index 9f131d8182ee0388b02788112468c0662e7d2051..ccee7abd54e83431607c542078f4de4615803107 100644 (file)
--- a/src/utils/pool_relcache.c
+++ b/src/utils/pool_relcache.c
@@ -110,7 +110,7 @@ pool_search_relcache(POOL_RELCACHE * relcache, POOL_CONNECTION_POOL * backend, c
        char       *dbname;
        int                     i;
        int                     maxrefcnt = INT_MAX;
-       char            query[1024];
+       char            query[MAX_QUERY_LENGTH];
        POOL_SELECT_RESULT *res = NULL;
        int                     index = 0;
        int                     local_session_id;

diff --git a/src/utils/pool_select_walker.c b/src/utils/pool_select_walker.c
index f093d7dc94bbfd1e66e2d5439f40a1671cd8507f..01fcd52a6b49ee52a0c21e5cfc97f74d65716651 100644 (file)
--- a/src/utils/pool_select_walker.c
+++ b/src/utils/pool_select_walker.c
@@ -3,7 +3,7 @@
  * pgpool: a language independent connection pool server for PostgreSQL
  * written by Tatsuo Ishii
  *
- * Copyright (c) 2003-2021     PgPool Global Development Group
+ * Copyright (c) 2003-2023     PgPool Global Development Group
  *
  * Permission to use, copy, modify, and distribute this software and
  * its documentation for any purpose and without fee is hereby
@@ -559,11 +559,11 @@ is_system_catalog(char *table_name)
 /*
  * Query to know if the target table belongs pg_catalog schema.
  */
-#define ISBELONGTOPGCATALOGQUERY "SELECT count(*) FROM pg_class AS c, pg_namespace AS n WHERE c.relname = '%s' AND c.relnamespace = n.oid AND n.nspname = 'pg_catalog'"
+#define ISBELONGTOPGCATALOGQUERY "SELECT count(*) FROM pg_catalog.pg_class AS c, pg_namespace AS n WHERE c.relname = '%s' AND c.relnamespace = n.oid AND n.nspname = 'pg_catalog'"
 
-#define ISBELONGTOPGCATALOGQUERY2 "SELECT count(*) FROM pg_class AS c, pg_namespace AS n WHERE c.oid = pgpool_regclass('\"%s\"') AND c.relnamespace = n.oid AND n.nspname = 'pg_catalog'"
+#define ISBELONGTOPGCATALOGQUERY2 "SELECT count(*) FROM pg_catalog.pg_class AS c, pg_namespace AS n WHERE c.oid = pgpool_regclass('\"%s\"') AND c.relnamespace = n.oid AND n.nspname = 'pg_catalog'"
 
-#define ISBELONGTOPGCATALOGQUERY3 "SELECT count(*) FROM pg_class AS c, pg_namespace AS n WHERE c.oid = pg_catalog.to_regclass('\"%s\"') AND c.relnamespace = n.oid AND n.nspname = 'pg_catalog'"
+#define ISBELONGTOPGCATALOGQUERY3 "SELECT count(*) FROM pg_catalog.pg_class AS c, pg_namespace AS n WHERE c.oid = pg_catalog.to_regclass('\"%s\"') AND c.relnamespace = n.oid AND n.nspname = 'pg_catalog'"
 
        bool            result;
        static POOL_RELCACHE * relcache;
@@ -911,7 +911,7 @@ pool_has_pgpool_regclass(void)
 /*
  * Query to know if pgpool_regclass exists.
  */
-#define HASPGPOOL_REGCLASSQUERY "SELECT count(*) from (SELECT has_function_privilege('%s', 'pgpool_regclass(cstring)', 'execute') WHERE EXISTS(SELECT * FROM pg_catalog.pg_proc AS p WHERE p.proname = 'pgpool_regclass')) AS s"
+#define HASPGPOOL_REGCLASSQUERY "SELECT count(*) from (SELECT pg_catalog.has_function_privilege('%s', 'pgpool_regclass(cstring)', 'execute') WHERE EXISTS(SELECT * FROM pg_catalog.pg_proc AS p WHERE p.proname = 'pgpool_regclass')) AS s"
 
        bool            result;
        static POOL_RELCACHE * relcache;
@@ -1199,7 +1199,7 @@ pool_table_name_to_oid(char *table_name)
  * Query to convert table name to oid
  */
 #define TABLE_TO_OID_QUERY "SELECT pgpool_regclass('%s')"
-#define TABLE_TO_OID_QUERY2 "SELECT oid FROM pg_class WHERE relname = '%s'"
+#define TABLE_TO_OID_QUERY2 "SELECT oid FROM pg_catalog.pg_class WHERE relname = '%s'"
 #define TABLE_TO_OID_QUERY3 "SELECT COALESCE(pg_catalog.to_regclass('%s')::oid, 0)"
 
        int                     oid = 0;
@@ -1505,7 +1505,7 @@ bool function_has_return_type(char *fname, char *typename)
 /*
  * Query to count the number of records matching given function name and type name.
  */
-#define FUNCTION_RETURN_TYPE_MATCHEING_QUERY "SELECT count(*) FROM pg_type AS t, pg_catalog.pg_proc AS p, pg_catalog.pg_namespace AS n WHERE p.proname = '%s' AND n.oid = p.pronamespace AND n.nspname %s '%s' AND p.prorettype = t.oid AND t.typname = '%s';"
+#define FUNCTION_RETURN_TYPE_MATCHEING_QUERY "SELECT count(*) FROM pg_catalog.pg_type AS t, pg_catalog.pg_proc AS p, pg_catalog.pg_namespace AS n WHERE p.proname = '%s' AND n.oid = p.pronamespace AND n.nspname %s '%s' AND p.prorettype = t.oid AND t.typname = '%s';"
        bool            result;
        char            query[1024];
        char       *rawstring = NULL;