Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 632cd9f

Browse files
committed
Create new ParseExprKind for use by policy expressions.
Policy USING and WITH CHECK expressions were using EXPR_KIND_WHERE for parse analysis, which results in inappropriate ERROR messages when the expression contains unsupported constructs such as aggregates. Create a new ParseExprKind called EXPR_KIND_POLICY and tailor the related messages to fit. Reported by Noah Misch. Reviewed by Dean Rasheed, Alvaro Herrera, and Robert Haas. Back-patch to 9.5 where RLS was introduced.
1 parent f04ce31 commit 632cd9f

File tree

7 files changed

+39
-7
lines changed

7 files changed

+39
-7
lines changed

src/backend/commands/policy.c

+4-4
Original file line numberDiff line numberDiff line change
@@ -534,12 +534,12 @@ CreatePolicy(CreatePolicyStmt *stmt)
534534

535535
qual = transformWhereClause(qual_pstate,
536536
copyObject(stmt->qual),
537-
EXPR_KIND_WHERE,
537+
EXPR_KIND_POLICY,
538538
"POLICY");
539539

540540
with_check_qual = transformWhereClause(with_check_pstate,
541541
copyObject(stmt->with_check),
542-
EXPR_KIND_WHERE,
542+
EXPR_KIND_POLICY,
543543
"POLICY");
544544

545545
/* Fix up collation information */
@@ -707,7 +707,7 @@ AlterPolicy(AlterPolicyStmt *stmt)
707707
addRTEtoQuery(qual_pstate, rte, false, true, true);
708708

709709
qual = transformWhereClause(qual_pstate, copyObject(stmt->qual),
710-
EXPR_KIND_WHERE,
710+
EXPR_KIND_POLICY,
711711
"POLICY");
712712

713713
/* Fix up collation information */
@@ -730,7 +730,7 @@ AlterPolicy(AlterPolicyStmt *stmt)
730730

731731
with_check_qual = transformWhereClause(with_check_pstate,
732732
copyObject(stmt->with_check),
733-
EXPR_KIND_WHERE,
733+
EXPR_KIND_POLICY,
734734
"POLICY");
735735

736736
/* Fix up collation information */

src/backend/parser/parse_agg.c

+10
Original file line numberDiff line numberDiff line change
@@ -372,6 +372,13 @@ check_agglevels_and_constraints(ParseState *pstate, Node *expr)
372372
break;
373373
case EXPR_KIND_WHERE:
374374
errkind = true;
375+
break;
376+
case EXPR_KIND_POLICY:
377+
if (isAgg)
378+
err = _("aggregate functions are not allowed in policy expressions");
379+
else
380+
err = _("grouping operations are not allowed in policy expressions");
381+
375382
break;
376383
case EXPR_KIND_HAVING:
377384
/* okay */
@@ -770,6 +777,9 @@ transformWindowFuncCall(ParseState *pstate, WindowFunc *wfunc,
770777
case EXPR_KIND_WHERE:
771778
errkind = true;
772779
break;
780+
case EXPR_KIND_POLICY:
781+
err = _("window functions are not allowed in policy expressions");
782+
break;
773783
case EXPR_KIND_HAVING:
774784
errkind = true;
775785
break;

src/backend/parser/parse_expr.c

+3
Original file line numberDiff line numberDiff line change
@@ -1672,6 +1672,7 @@ transformSubLink(ParseState *pstate, SubLink *sublink)
16721672
case EXPR_KIND_FROM_SUBSELECT:
16731673
case EXPR_KIND_FROM_FUNCTION:
16741674
case EXPR_KIND_WHERE:
1675+
case EXPR_KIND_POLICY:
16751676
case EXPR_KIND_HAVING:
16761677
case EXPR_KIND_FILTER:
16771678
case EXPR_KIND_WINDOW_PARTITION:
@@ -3173,6 +3174,8 @@ ParseExprKindName(ParseExprKind exprKind)
31733174
return "function in FROM";
31743175
case EXPR_KIND_WHERE:
31753176
return "WHERE";
3177+
case EXPR_KIND_POLICY:
3178+
return "POLICY";
31763179
case EXPR_KIND_HAVING:
31773180
return "HAVING";
31783181
case EXPR_KIND_FILTER:

src/include/parser/parse_node.h

+2-1
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,8 @@ typedef enum ParseExprKind
6363
EXPR_KIND_INDEX_PREDICATE, /* index predicate */
6464
EXPR_KIND_ALTER_COL_TRANSFORM, /* transform expr in ALTER COLUMN TYPE */
6565
EXPR_KIND_EXECUTE_PARAMETER, /* parameter value in EXECUTE */
66-
EXPR_KIND_TRIGGER_WHEN /* WHEN condition in CREATE TRIGGER */
66+
EXPR_KIND_TRIGGER_WHEN, /* WHEN condition in CREATE TRIGGER */
67+
EXPR_KIND_POLICY /* USING or WITH CHECK expr in policy */
6768
} ParseExprKind;
6869

6970

src/test/modules/test_rls_hooks/test_rls_hooks.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ test_rls_hooks_permissive(CmdType cmdtype, Relation relation)
106106
e = (Node *) makeSimpleA_Expr(AEXPR_OP, "=", (Node *) n, (Node *) c, 0);
107107

108108
policy->qual = (Expr *) transformWhereClause(qual_pstate, copyObject(e),
109-
EXPR_KIND_WHERE,
109+
EXPR_KIND_POLICY,
110110
"POLICY");
111111

112112
policy->with_check_qual = copyObject(policy->qual);
@@ -160,7 +160,7 @@ test_rls_hooks_restrictive(CmdType cmdtype, Relation relation)
160160
e = (Node *) makeSimpleA_Expr(AEXPR_OP, "=", (Node *) n, (Node *) c, 0);
161161

162162
policy->qual = (Expr *) transformWhereClause(qual_pstate, copyObject(e),
163-
EXPR_KIND_WHERE,
163+
EXPR_KIND_POLICY,
164164
"POLICY");
165165

166166
policy->with_check_qual = copyObject(policy->qual);

src/test/regress/expected/rowsecurity.out

+9
Original file line numberDiff line numberDiff line change
@@ -3024,6 +3024,15 @@ CREATE RULE "_RETURN" AS ON SELECT TO t DO INSTEAD
30243024
SELECT * FROM generate_series(1,5) t0(c); -- succeeds
30253025
ROLLBACK;
30263026
--
3027+
-- Policy expression handling
3028+
--
3029+
BEGIN;
3030+
SET row_security = FORCE;
3031+
CREATE TABLE t (c) AS VALUES ('bar'::text);
3032+
CREATE POLICY p ON t USING (max(c)); -- fails: aggregate functions are not allowed in policy expressions
3033+
ERROR: aggregate functions are not allowed in policy expressions
3034+
ROLLBACK;
3035+
--
30273036
-- Clean up objects
30283037
--
30293038
RESET SESSION AUTHORIZATION;

src/test/regress/sql/rowsecurity.sql

+9
Original file line numberDiff line numberDiff line change
@@ -1289,6 +1289,15 @@ CREATE RULE "_RETURN" AS ON SELECT TO t DO INSTEAD
12891289
SELECT * FROM generate_series(1,5) t0(c); -- succeeds
12901290
ROLLBACK;
12911291

1292+
--
1293+
-- Policy expression handling
1294+
--
1295+
BEGIN;
1296+
SET row_security = FORCE;
1297+
CREATE TABLE t (c) AS VALUES ('bar'::text);
1298+
CREATE POLICY p ON t USING (max(c)); -- fails: aggregate functions are not allowed in policy expressions
1299+
ROLLBACK;
1300+
12921301
--
12931302
-- Clean up objects
12941303
--

0 commit comments

Comments
 (0)