fix: reconstruct materialized views WITH NO DATA during validation - #305
Merged
Conversation
jtayal-stripe
force-pushed
the
fix/matview-with-no-data
branch
from
August 5, 2026 14:11
8debbb2 to
6c43b7f
Compare
During plan validation, setSchemaForEmptyDatabase reconstructs the source schema in a temporary database. For materialized views, the Add() method emitted CREATE MATERIALIZED VIEW ... AS <query> without WITH NO DATA, causing Postgres to execute the view's stored query with the operator's privileges. A low-privileged user could plant a materialized view WITH NO DATA whose body calls a SECURITY INVOKER function running COPY ... TO PROGRAM. When a privileged operator later runs pg-schema-diff plan, the view would be reconstructed WITH DATA, executing the malicious function as the operator. The fix appends WITH NO DATA to all CREATE MATERIALIZED VIEW statements. pg-schema-diff generates migration plans and should never implicitly execute user-defined queries during schema reconstruction. Also strips trailing semicolons from pg_get_viewdef() output to prevent syntax errors. Co-authored-by: Cursor <cursoragent@cursor.com> Committed-By-Agent: cursor Co-authored-by: Cursor <cursoragent@cursor.com> Committed-By-Agent: cursor Co-authored-by: Cursor <cursoragent@cursor.com> Committed-By-Agent: cursor
jtayal-stripe
force-pushed
the
fix/matview-with-no-data
branch
from
August 6, 2026 09:18
6c43b7f to
775e2a1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix a bug where materialized views were reconstructed
WITH DATAduring plan validation, causing their stored queries to execute unnecessarily.Root cause:
materializedViewSQLGenerator.Add()emittedCREATE MATERIALIZED VIEW ... AS <query>withoutWITH NO DATA. Postgres defaults toWITH DATA, which populates the view by executing the stored query. This is both unnecessary (the temp database is discarded after validation) and potentially unsafe.Fix:
WITH NO DATAto allCREATE MATERIALIZED VIEWDDL generated during schema reconstructionpg_get_viewdef()output before appendingWITH NO DATAto prevent syntax errorsChanges
pkg/diff/materialized_view_sql_generator.goAdd()now emitsCREATE MATERIALIZED VIEW ... AS <query> WITH NO DATAinstead ofCREATE MATERIALIZED VIEW ... AS <query>pg_get_viewdef()are trimmed viastrings.TrimRightso thatWITH NO DATAis part of the same statementpkg/diff/schema_migration_plan_test.goThree new unit test cases:
WITH NO DATAWITH NO DATAfillfactor) includeWITH NO DATATest results
Without fix (tests FAIL) -- proving the bug exists
Tests were run against the codebase before the fix was applied (fix stashed), confirming the bug:
With fix (tests PASS)
Full test suite (no regressions)
All 14 packages pass, 0 failures.
Test plan
Add()generates DDL withWITH NO DATAWITH NO DATAWITH NO DATA