mirror of
https://git.postgresql.org/git/postgresql.git
synced 2026-02-12 17:37:07 +08:00
52a4413627
It's unusual to have any resjunk columns in an ON CONFLICT ... UPDATE list, but it can happen when MULTIEXPR_SUBLINK SubPlans are present. If it happens, the ON CONFLICT UPDATE code path would end up storing tuples that include the values of the extra resjunk columns. That's fairly harmless in the short run, but if new columns are added to the table then the values would become accessible, possibly leading to malfunctions if they don't match the datatypes of the new columns. This had escaped notice through a confluence of missing sanity checks, including * There's no cross-check that a tuple presented to heap_insert or heap_update matches the table rowtype. While it's difficult to check that fully at reasonable cost, we can easily add assertions that there aren't too many columns. * The output-column-assignment cases in execExprInterp.c lacked any sanity checks on the output column numbers, which seems like an oversight considering there are plenty of assertion checks on input column numbers. Add assertions there too. * We failed to apply nodeModifyTable's ExecCheckPlanOutput() to the ON CONFLICT UPDATE tlist. That wouldn't have caught this specific error, since that function is chartered to ignore resjunk columns; but it sure seems like a bad omission now that we've seen this bug. In HEAD, the right way to fix this is to make the processing of ON CONFLICT UPDATE tlists work the same as regular UPDATE tlists now do, that is don't add "SET x = x" entries, and use ExecBuildUpdateProjection to evaluate the tlist and combine it with old values of the not-set columns. This adds a little complication to ExecBuildUpdateProjection, but allows removal of a comparable amount of now-dead code from the planner. In the back branches, the most expedient solution seems to be to (a) use an output slot for the ON CONFLICT UPDATE projection that actually matches the target table, and then (b) invent a variant of ExecBuildProjectionInfo that can be told to not store values resulting from resjunk columns, so it doesn't try to store into nonexistent columns of the output slot. (We can't simply ignore the resjunk columns altogether; they have to be evaluated for MULTIEXPR_SUBLINK to work.) This works back to v10. In 9.6, projections work much differently and we can't cheaply give them such an option. The 9.6 version of this patch works by inserting a JunkFilter when it's necessary to get rid of resjunk columns. In addition, v11 and up have the reverse problem when trying to perform ON CONFLICT UPDATE on a partitioned table. Through a further oversight, adjust_partition_tlist() discarded resjunk columns when re-ordering the ON CONFLICT UPDATE tlist to match a partition. This accidentally prevented the storing-bogus-tuples problem, but at the cost that MULTIEXPR_SUBLINK cases didn't work, typically crashing if more than one row has to be updated. Fix by preserving resjunk columns in that routine. (I failed to resist the temptation to add more assertions there too, and to do some minor code beautification.) Per report from Andres Freund. Back-patch to all supported branches. Security: CVE-2021-32028
140 lines
4.4 KiB
SQL
140 lines
4.4 KiB
SQL
--
|
|
-- UPDATE syntax tests
|
|
--
|
|
|
|
CREATE TABLE update_test (
|
|
a INT DEFAULT 10,
|
|
b INT,
|
|
c TEXT
|
|
);
|
|
|
|
CREATE TABLE upsert_test (
|
|
a INT PRIMARY KEY,
|
|
b TEXT
|
|
);
|
|
|
|
INSERT INTO update_test VALUES (5, 10, 'foo');
|
|
INSERT INTO update_test(b, a) VALUES (15, 10);
|
|
|
|
SELECT * FROM update_test;
|
|
|
|
UPDATE update_test SET a = DEFAULT, b = DEFAULT;
|
|
|
|
SELECT * FROM update_test;
|
|
|
|
-- aliases for the UPDATE target table
|
|
UPDATE update_test AS t SET b = 10 WHERE t.a = 10;
|
|
|
|
SELECT * FROM update_test;
|
|
|
|
UPDATE update_test t SET b = t.b + 10 WHERE t.a = 10;
|
|
|
|
SELECT * FROM update_test;
|
|
|
|
--
|
|
-- Test VALUES in FROM
|
|
--
|
|
|
|
UPDATE update_test SET a=v.i FROM (VALUES(100, 20)) AS v(i, j)
|
|
WHERE update_test.b = v.j;
|
|
|
|
SELECT * FROM update_test;
|
|
|
|
-- fail, wrong data type:
|
|
UPDATE update_test SET a = v.* FROM (VALUES(100, 20)) AS v(i, j)
|
|
WHERE update_test.b = v.j;
|
|
|
|
--
|
|
-- Test multiple-set-clause syntax
|
|
--
|
|
|
|
INSERT INTO update_test SELECT a,b+1,c FROM update_test;
|
|
SELECT * FROM update_test;
|
|
|
|
UPDATE update_test SET (c,b,a) = ('bugle', b+11, DEFAULT) WHERE c = 'foo';
|
|
SELECT * FROM update_test;
|
|
UPDATE update_test SET (c,b) = ('car', a+b), a = a + 1 WHERE a = 10;
|
|
SELECT * FROM update_test;
|
|
-- fail, multi assignment to same column:
|
|
UPDATE update_test SET (c,b) = ('car', a+b), b = a + 1 WHERE a = 10;
|
|
|
|
-- uncorrelated sub-select:
|
|
UPDATE update_test
|
|
SET (b,a) = (select a,b from update_test where b = 41 and c = 'car')
|
|
WHERE a = 100 AND b = 20;
|
|
SELECT * FROM update_test;
|
|
-- correlated sub-select:
|
|
UPDATE update_test o
|
|
SET (b,a) = (select a+1,b from update_test i
|
|
where i.a=o.a and i.b=o.b and i.c is not distinct from o.c);
|
|
SELECT * FROM update_test;
|
|
-- fail, multiple rows supplied:
|
|
UPDATE update_test SET (b,a) = (select a+1,b from update_test);
|
|
-- set to null if no rows supplied:
|
|
UPDATE update_test SET (b,a) = (select a+1,b from update_test where a = 1000)
|
|
WHERE a = 11;
|
|
SELECT * FROM update_test;
|
|
-- *-expansion should work in this context:
|
|
UPDATE update_test SET (a,b) = ROW(v.*) FROM (VALUES(21, 100)) AS v(i, j)
|
|
WHERE update_test.a = v.i;
|
|
-- you might expect this to work, but syntactically it's not a RowExpr:
|
|
UPDATE update_test SET (a,b) = (v.*) FROM (VALUES(21, 101)) AS v(i, j)
|
|
WHERE update_test.a = v.i;
|
|
|
|
-- if an alias for the target table is specified, don't allow references
|
|
-- to the original table name
|
|
UPDATE update_test AS t SET b = update_test.b + 10 WHERE t.a = 10;
|
|
|
|
-- Make sure that we can update to a TOASTed value.
|
|
UPDATE update_test SET c = repeat('x', 10000) WHERE c = 'car';
|
|
SELECT a, b, char_length(c) FROM update_test;
|
|
|
|
-- Check multi-assignment with a Result node to handle a one-time filter.
|
|
EXPLAIN (VERBOSE, COSTS OFF)
|
|
UPDATE update_test t
|
|
SET (a, b) = (SELECT b, a FROM update_test s WHERE s.a = t.a)
|
|
WHERE CURRENT_USER = SESSION_USER;
|
|
UPDATE update_test t
|
|
SET (a, b) = (SELECT b, a FROM update_test s WHERE s.a = t.a)
|
|
WHERE CURRENT_USER = SESSION_USER;
|
|
SELECT a, b, char_length(c) FROM update_test;
|
|
|
|
-- Test ON CONFLICT DO UPDATE
|
|
INSERT INTO upsert_test VALUES(1, 'Boo'), (3, 'Zoo');
|
|
-- uncorrelated sub-select:
|
|
WITH aaa AS (SELECT 1 AS a, 'Foo' AS b) INSERT INTO upsert_test
|
|
VALUES (1, 'Bar') ON CONFLICT(a)
|
|
DO UPDATE SET (b, a) = (SELECT b, a FROM aaa) RETURNING *;
|
|
-- correlated sub-select:
|
|
INSERT INTO upsert_test VALUES (1, 'Baz'), (3, 'Zaz') ON CONFLICT(a)
|
|
DO UPDATE SET (b, a) = (SELECT b || ', Correlated', a from upsert_test i WHERE i.a = upsert_test.a)
|
|
RETURNING *;
|
|
-- correlated sub-select (EXCLUDED.* alias):
|
|
INSERT INTO upsert_test VALUES (1, 'Bat'), (3, 'Zot') ON CONFLICT(a)
|
|
DO UPDATE SET (b, a) = (SELECT b || ', Excluded', a from upsert_test i WHERE i.a = excluded.a)
|
|
RETURNING *;
|
|
|
|
DROP TABLE update_test;
|
|
DROP TABLE upsert_test;
|
|
|
|
-- update to a partition should check partition bound constraint for the new tuple
|
|
create table range_parted (
|
|
a text,
|
|
b int
|
|
) partition by range (a, b);
|
|
create table part_a_1_a_10 partition of range_parted for values from ('a', 1) to ('a', 10);
|
|
create table part_a_10_a_20 partition of range_parted for values from ('a', 10) to ('a', 20);
|
|
create table part_b_1_b_10 partition of range_parted for values from ('b', 1) to ('b', 10);
|
|
create table part_b_10_b_20 partition of range_parted for values from ('b', 10) to ('b', 20);
|
|
insert into part_a_1_a_10 values ('a', 1);
|
|
insert into part_b_10_b_20 values ('b', 10);
|
|
|
|
-- fail
|
|
update part_a_1_a_10 set a = 'b' where a = 'a';
|
|
update range_parted set b = b - 1 where b = 10;
|
|
-- ok
|
|
update range_parted set b = b + 1 where b = 10;
|
|
|
|
-- cleanup
|
|
drop table range_parted;
|