test(postgres): pin CVE-2026-2004 operator superuser-gate#2166
Draft
utkarash2991 wants to merge 1 commit into
Draft
test(postgres): pin CVE-2026-2004 operator superuser-gate#2166utkarash2991 wants to merge 1 commit into
utkarash2991 wants to merge 1 commit into
Conversation
Adds a pg_regress regression that exercises the new check from CVE-2026-2004 (landed 15.16 / 17.8). Non-superuser is verified to be rejected on both RESTRICT = non-built-in and JOIN = non-built-in, then verified to still succeed with built-in selectivity estimators. Without this regression, the same class of failure could silently regress on a future PG major upgrade. Refs: PSQL-1110, PSQL-1234
PostgreSQL Extension Dependency Analysis: PR #2166
SummaryNo extensions had dependencies with MAJOR version updates. Full Analysis ResultsPostgreSQL 15 Extension DependenciesPostgreSQL 17 Extension DependenciesOrioleDB 17 Extension Dependencies |
PostgreSQL Package Dependency Analysis: PR #2166
SummaryNo packages had MAJOR version updates. Full Analysis ResultsPostgreSQL 15 Dependency ChangesExtracting PostgreSQL 15 dependencies...
Runtime Closure Size
Raw Dependency ClosurePostgreSQL 17 Dependency ChangesExtracting PostgreSQL 17 dependencies...
Runtime Closure Size
Raw Dependency Closure |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What kind of change does this PR introduce?
Test addition — pg_regress regression pinning the CVE-2026-2004 operator-superuser-gate behaviour.
Related Linear tickets: PSQL-1234 (this PR), PSQL-1110 (CVE analysis).
What is the current behavior?
No CI coverage for the CVE-2026-2004 gate. If a future PG major upgrade silently altered or removed the check — or if our build harness ever stripped it via a custom patch — CI would not catch it.
What is the new behavior?
nix/tests/sql/operator_breaking_change.sqlruns as part of the pg_regress suite. As a non-superuser (postgresrole), it exercises three cases:CREATE OPERATOR ... RESTRICT = <non-built-in>→ rejected withERROR: must be superuser to specify a non-built-in restriction estimator functionCREATE OPERATOR ... JOIN = <non-built-in>→ rejected withERROR: must be superuser to specify a non-built-in join estimator functionCREATE OPERATOR ... RESTRICT = eqsel, JOIN = eqjoinsel→ still succeeds (built-in path is unaffected)Uses transaction +
SAVEPOINTto recover from expected errors, mirroring thesupautils_reserved_roles.sqlpattern.The non-built-in selectivity estimators are stub user functions (
fake_restrict_sel,fake_join_sel) with matching signatures — avoids dependency onintarrayor other contrib while still triggering the OID>= FirstGenbkiObjectId(10000) check the upstream patch added.Additional context
b764b26f(PG 15.16),bbf5bcf5(PG 17.8) insrc/backend/commands/operatorcmds.c