mirror of
https://github.com/timescale/timescaledb.git
synced 2025-05-14 09:37:00 +08:00
c8b8516e46
TimescaleDB was vulnerable to a privilege escalation attack in the extension installation script. An attacker could precreate objects normally owned by the extension and get those objects used in the installation script since the script would only try to create them if they did not already exist. Thanks to Pedro Gallegos for reporting the problem. This patch changes the schema, table and function creation to fail and abort the installation when the object already exists instead of using the existing object. Security: CVE-2022-24128
27 lines
713 B
CMake
27 lines
713 B
CMake
|
|
IF(POLICY CMP0012)
|
|
CMAKE_POLICY(SET CMP0012 NEW)
|
|
ENDIF()
|
|
|
|
if (NOT DEFINED STRIP_REPLACE)
|
|
set(STRIP_REPLACE OFF)
|
|
endif()
|
|
|
|
function(append_file IN_FILE OUT_FILE STRIP_REPLACE)
|
|
file(READ ${IN_FILE} CONTENTS)
|
|
if (${STRIP_REPLACE})
|
|
string(REPLACE " OR REPLACE " " " CONTENTS "${CONTENTS}")
|
|
endif()
|
|
file(APPEND ${OUT_FILE} "${CONTENTS}")
|
|
endfunction()
|
|
|
|
# Function to concatenate all files in SRC_FILE_LIST into file OUTPUT_FILE
|
|
function(cat SRC_FILE_LIST OUTPUT_FILE STRIP_REPLACE)
|
|
file(WRITE ${OUTPUT_FILE} "")
|
|
foreach(SRC_FILE ${SRC_FILE_LIST})
|
|
append_file(${SRC_FILE} ${OUTPUT_FILE} ${STRIP_REPLACE})
|
|
endforeach()
|
|
endfunction()
|
|
|
|
cat("${SRC_FILE_LIST}" "${OUTPUT_FILE}" "${STRIP_REPLACE}")
|