Repository navigation
fix(persistence): fail closed on Unicode-escaped set_config builtin identity #587
Description
Activity
Ordinary-forward lineage is now public on #521: RED
8cead208310257e59fcb7779a09049c966a11ff8→ bounded production repair6de2b13dcd1432fc3c64eed44890763fcf836f21→ supplemental contract controls9b47d91c0e7996fef6973b4b1aaaa9c22b6f7b2b. The repair adds one documented post-lexical projection for UnicodeU&function/schema identity before the existingset_configargument authority; exactset_config/pg_catalogand unresolvedINVALID_QUOTED_IDENTIFIERin those positions are treated as canonical/potentially canonical, while safely projected unrelated names remain unrelated. It does not decode raw SQL or replace the shared lexer.Supplemental controls cover explicit
UESCAPE, both schema and function escaped together, named arguments, direct-safeorigin/local, unrelated escaped schema+function, rollback, and opaque regions. Current exact-head hosted Rust Foundation run35342901599skipped bothFormat, lint, test, rustdoc, and dependency policyandLive PostgreSQL integrationbecause #521 remains Draft, so no hosted GREEN is claimed.A scoped CodeRabbit review was requested for exact
9b47d91...; keep this issue open pending that finding sweep and the post-#538 restack/promotion evidence.Exact-head review on
9b47d91...found one valid bypass: shared lexical normalization masks non-atomicUESCAPE '!', leavingU& INVALID_QUOTED_IDENTIFIER UESCAPE (; the projector incorrectly required a retained quoted escape token and therefore left the canonical function unresolved. That exact supplemental UESCAPE contract is the public RED for the review finding.Ordinary-forward repair is
0790db3b27bb1eb12ec4cdaf11a78c66c96c8de6. Delta from9b47d91...is one production file, +9/-6. After normalizedUESCAPE, the projector now consumes an optional retained quoted atom when the shared lexer preserved one, but also accepts marker-only projection when the non-atomic escape literal was intentionally masked. No raw-SQL decoding was added. Exact-head run35343228062remains Draft-skipped across format/lint/test/rustdoc/dependency policy, repository/Python coverage, Live PostgreSQL, and production line/branch coverage, so no hosted GREEN is claimed.Scoped re-review requested on
0790db3...; keep #587 open pending that verdict and post-#538 promotion evidence.Scoped re-review is now complete on exact
0790db3b27bb1eb12ec4cdaf11a78c66c96c8de6. CodeRabbit verified the requested head and the9b47d91...RED ancestry and found no source-level bypass or false positive in the requested #587 scope after the masked-UESCAPErepair. This is source-review evidence only; it does not replace hosted Rust/Live PostgreSQL, current-topology rustdoc/coverage/security, or a qualifying submitted approval. #587 therefore remains open pending post-#538 restack/promotion evidence.
Finding
#585/#586 bound PostgreSQL Unicode-escaped identifier spellings for writable
pg_settingsand direct genericSET, but theset_config(...)execution-context path still discovers the builtin by searching normalized text for the literal substringset_configand then classifying only ordinary unqualified orpg_catalog.identity. The shared lexer does not yet decode PostgreSQLU&"..."identifiers to their final identifier identity.PostgreSQL 18 accepts Unicode-escaped quoted identifiers and decodes code-point escapes before ordinary identifier semantics. Therefore canonical builtin spellings such as:
and canonical schema qualification such as:
resolve to PostgreSQL's
set_configbuiltin path but can avoid the current literal-name/builtin-identity matcher after lexical projection.set_configis PostgreSQL's function equivalent ofSET, andsession_replication_role=replicasuppresses ordinary/default triggers and rules. This can therefore bypass append-only/retention execution-context enforcement while final catalog definitions still look safe.Primary PostgreSQL 18 authority:
U&"...", code-point escapes, optionalUESCAPE) are identifier syntax: https://www.postgresql.org/docs/18/sql-syntax-lexical.htmlset_config(setting_name, new_value, is_local)is the SQL-function equivalent ofSET: https://www.postgresql.org/docs/18/config-setting.htmlsession_replication_role=replicasuppresses default/origin triggers and rules: https://www.postgresql.org/docs/18/runtime-config-client.html#GUC-SESSION-REPLICATION-ROLERequired contract
At exported
validate_migration_catalog():U&"set_\0063onfig"('session_replication_role','replica',false)must fail the runtime-role contract;pg_catalogqualification must cross the same boundary;UESCAPEspellings equivalent toset_config/pg_catalogmust not bypass detection;origin/localvalues remain accepted once builtin identity is established;Keep open until post-#538 non-force-restack exact-head hosted Rust/Live PostgreSQL, current-topology rustdoc/coverage/security, resolved valid findings, and qualifying independent approval exist. Draft-skipped execution is not GREEN.