Skip to content

Commit 97d8f84

Browse files
IvanHuntersIvanHunters
committed
fix(postgres): update security denylist for parameter blocking
Remove log_destination and event_source (not code-execution vectors). Add dynamic_library_path, local_preload_libraries, session_preload_libraries, shared_preload_libraries which allow loading arbitrary .so files. Improve error message accuracy. Signed-off-by: IvanHunters <[email protected]>
1 parent 6ec761f commit 97d8f84

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

  • packages/apps/postgres/templates

‎packages/apps/postgres/templates/db.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -62,12 +62,12 @@ spec:
6262
parameters:
6363
{{- $defaults := dict "max_wal_senders" "30" }}
6464
{{- $params := merge (dict) .Values.postgresql.parameters $defaults }}
65-
{{- /* Security: Block parameters that could allow shell command execution */ -}}
66-
{{- $dangerousParams := list "archive_command" "restore_command" "ssl_passphrase_command" "log_destination" "event_source" }}
65+
{{- /* Security: Block parameters that enable arbitrary code execution (shell commands or .so loading) */ -}}
66+
{{- $dangerousParams := list "archive_command" "restore_command" "ssl_passphrase_command" "dynamic_library_path" "local_preload_libraries" "session_preload_libraries" "shared_preload_libraries" }}
6767
{{- range $key, $value := $params }}
6868
{{- $normalizedKey := lower $key }}
6969
{{- if has $normalizedKey $dangerousParams }}
70-
{{- fail (printf "SECURITY: Parameter '%s' is blocked for security reasons. This parameter could allow arbitrary shell command execution and is managed by CloudNativePG operator." $key) }}
70+
{{- fail (printf "SECURITY: Parameter '%s' is blocked. This parameter can enable arbitrary code execution and must not be set by tenants." $key) }}
7171
{{- end }}
7272
{{ $key }}: {{ $value | toString | quote }}
7373
{{- end }}

0 commit comments

Comments
 (0)