Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 594ee1a

Browse files
committed
Make contrib/unaccent's unaccent() function work when not in search path.
Since the fixes for CVE-2018-1058, we've advised people to schema-qualify function references in order to fix failures in code that executes under a minimal search_path setting. However, that's insufficient to make the single-argument form of unaccent() work, because it looks up the "unaccent" text search dictionary using the search path. The most expedient answer seems to be to remove the search_path dependency by making it look in the same schema that the unaccent() function itself is declared in. This will definitely work for the normal usage of this function with the unaccent dictionary provided by the extension. It's barely possible that there are people who were relying on the search-path-dependent behavior to select other dictionaries with the same name; but if there are any such people at all, they can still get that behavior by writing unaccent('unaccent', ...), or possibly unaccent('unaccent'::text::regdictionary, ...) if the lookup has to be postponed to runtime. Per complaint from Gunnlaugur Thor Briem. Back-patch to all supported branches. Discussion: https://postgr.es/m/CAPs+M8LCex6d=DeneofdsoJVijaG59m9V0ggbb3pOH7hZO4+cQ@mail.gmail.com
1 parent 5b114b0 commit 594ee1a

File tree

2 files changed

+22
-4
lines changed

2 files changed

+22
-4
lines changed

contrib/unaccent/unaccent.c

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@
2020
#include "tsearch/ts_locale.h"
2121
#include "tsearch/ts_public.h"
2222
#include "utils/builtins.h"
23+
#include "utils/lsyscache.h"
24+
#include "utils/syscache.h"
2325

2426
PG_MODULE_MAGIC;
2527

@@ -375,7 +377,21 @@ unaccent_dict(PG_FUNCTION_ARGS)
375377

376378
if (PG_NARGS() == 1)
377379
{
378-
dictOid = get_ts_dict_oid(stringToQualifiedNameList("unaccent"), false);
380+
/*
381+
* Use the "unaccent" dictionary that is in the same schema that this
382+
* function is in.
383+
*/
384+
Oid procnspid = get_func_namespace(fcinfo->flinfo->fn_oid);
385+
const char *dictname = "unaccent";
386+
387+
dictOid = GetSysCacheOid2(TSDICTNAMENSP,
388+
PointerGetDatum(dictname),
389+
ObjectIdGetDatum(procnspid));
390+
if (!OidIsValid(dictOid))
391+
ereport(ERROR,
392+
(errcode(ERRCODE_UNDEFINED_OBJECT),
393+
errmsg("text search dictionary \"%s.%s\" does not exist",
394+
get_namespace_name(procnspid), dictname)));
379395
strArg = 0;
380396
}
381397
else

doc/src/sgml/unaccent.sgml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -174,12 +174,14 @@ mydb=# select ts_headline('fr','Hôtel de la Mer',to_tsquery('fr','Hotels')
174174
</indexterm>
175175

176176
<synopsis>
177-
unaccent(<optional><replaceable class="PARAMETER">dictionary</replaceable>, </optional> <replaceable class="PARAMETER">string</replaceable>) returns <type>text</type>
177+
unaccent(<optional><replaceable class="parameter">dictionary</replaceable> <type>regdictionary</type>, </optional> <replaceable class="parameter">string</replaceable> <type>text</type>) returns <type>text</type>
178178
</synopsis>
179179

180180
<para>
181-
If the <replaceable class="PARAMETER">dictionary</replaceable> argument is
182-
omitted, <literal>unaccent</> is assumed.
181+
If the <replaceable class="parameter">dictionary</replaceable> argument is
182+
omitted, the text search dictionary named <literal>unaccent</literal> and
183+
appearing in the same schema as the <function>unaccent()</function>
184+
function itself is used.
183185
</para>
184186

185187
<para>

0 commit comments

Comments
 (0)