[SCM] PostGIS branch master updated. 3.7.0rc1-51-gfb915a676
git at osgeo.org
git at osgeo.org
Tue Sep 8 10:15:39 PDT 2026
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".
The branch, master has been updated
via fb915a6760c84984f86a671a306ee83fd38f413b (commit)
via a9634c0c735ae492efb3099d0cff0d26d0ce74be (commit)
from df51a62808292e9917409d2019ccd12ee700681b (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit fb915a6760c84984f86a671a306ee83fd38f413b
Merge: df51a6280 a9634c0c7
Author: Darafei Praliaskouski <komzpa at gmail.com>
Date: Tue Sep 8 10:15:37 2026 -0700
Merge pull request '[raster] Enforce postgis.enable_outdb_rasters' (!779) from Komzpa/postgis:codex/raster-outdb-guc-20260907 into master
Bind postgis.enable_outdb_rasters to the core offline-band guard used by
metadata and pixel reads. The documented default off setting now takes effect
after upgrade, while explicitly enabling out-db rasters preserves those reads.
In-database rasters are unaffected.
Reviewed-on: https://gitea.osgeo.org/postgis/postgis/pulls/779
commit a9634c0c735ae492efb3099d0cff0d26d0ce74be
Author: Darafei Praliaskouski <me at komzpa.net>
Date: Mon Sep 7 23:25:33 2026 +0400
[raster] Enforce postgis.enable_outdb_rasters
diff --git a/NEWS b/NEWS
index 069a05a2d..db1d0173f 100644
--- a/NEWS
+++ b/NEWS
@@ -132,6 +132,10 @@ To take advantage of all postgis_sfcgal extension features SFCGAL 2.3+ is needed
* Bug Fixes *
+ - [raster] Make postgis.enable_outdb_rasters=off enforce offline-band
+ metadata and pixel-read restrictions after upgrade
+ (reported by Sarath Kumar, IITM Pravartak Security Team;
+ fixed by Darafei Praliaskouski)
- GH-1175, Guard missing operands before reading node tags in
spatial selectivity estimation (Maksim Korotkov)
diff --git a/raster/rt_pg/rtpostgis.c b/raster/rt_pg/rtpostgis.c
index 4c8bd1a3f..fba4adfaf 100644
--- a/raster/rt_pg/rtpostgis.c
+++ b/raster/rt_pg/rtpostgis.c
@@ -481,7 +481,8 @@ rt_pg_vsi_check_options(char **newval, void **extra, GucSource source)
static char *gdal_datapath = NULL;
static char *gdal_vsi_options = NULL;
static char *gdal_enabled_drivers = NULL;
-static bool enable_outdb_rasters = false;
+/* Defined in rt_band.c and used by the offline-band access guards. */
+extern bool enable_outdb_rasters;
static bool gdal_cpl_debug = false;
/* ---------------------------------------------------------------- */
diff --git a/raster/test/regress/rt_outdb_guc.sql b/raster/test/regress/rt_outdb_guc.sql
new file mode 100644
index 000000000..1547c7d65
--- /dev/null
+++ b/raster/test/regress/rt_outdb_guc.sql
@@ -0,0 +1,88 @@
+CREATE FUNCTION outdb_guc_can_read_metadata(rast raster)
+RETURNS boolean
+AS $$
+BEGIN
+ PERFORM ST_BandFileSize(rast, 1);
+ RETURN true;
+EXCEPTION WHEN OTHERS THEN
+ RETURN false;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION outdb_guc_can_read_pixel(rast raster)
+RETURNS boolean
+AS $$
+BEGIN
+ PERFORM ST_Value(rast, 1, 1, 1);
+ RETURN true;
+EXCEPTION WHEN OTHERS THEN
+ RETURN false;
+END;
+$$ LANGUAGE plpgsql;
+
+DO $$
+BEGIN
+ PERFORM postgis_raster_lib_version();
+END;
+$$;
+
+CREATE ROLE outdb_guc_regression_guest;
+GRANT SELECT ON raster_outdb_template TO outdb_guc_regression_guest;
+GRANT EXECUTE ON FUNCTION outdb_guc_can_read_metadata(raster) TO outdb_guc_regression_guest;
+GRANT EXECUTE ON FUNCTION outdb_guc_can_read_pixel(raster) TO outdb_guc_regression_guest;
+
+SET postgis.gdal_enabled_drivers = 'GTiff';
+RESET postgis.enable_outdb_rasters;
+SHOW postgis.enable_outdb_rasters;
+SET ROLE outdb_guc_regression_guest;
+SELECT 'off_metadata', outdb_guc_can_read_metadata(rast)
+FROM raster_outdb_template WHERE rid = 1;
+SELECT 'off_pixel', outdb_guc_can_read_pixel(rast)
+FROM raster_outdb_template WHERE rid = 1;
+SELECT 'off_indb_pixel', (
+ ST_Value(
+ ST_AddBand(
+ ST_MakeEmptyRaster(1, 1, 0, 0, 1, -1, 0, 0, 0),
+ 1, '8BUI', 7, 0
+ ),
+ 1, 1, 1
+ ) = 7
+);
+
+RESET ROLE;
+SET postgis.enable_outdb_rasters = true;
+SET ROLE outdb_guc_regression_guest;
+SELECT 'on_metadata', outdb_guc_can_read_metadata(rast)
+FROM raster_outdb_template WHERE rid = 1;
+SELECT 'on_pixel', outdb_guc_can_read_pixel(rast)
+FROM raster_outdb_template WHERE rid = 1;
+
+RESET ROLE;
+RESET postgis.enable_outdb_rasters;
+SHOW postgis.enable_outdb_rasters;
+SET ROLE outdb_guc_regression_guest;
+SELECT 'reset_metadata', outdb_guc_can_read_metadata(rast)
+FROM raster_outdb_template WHERE rid = 1;
+SELECT 'reset_pixel', outdb_guc_can_read_pixel(rast)
+FROM raster_outdb_template WHERE rid = 1;
+
+RESET ROLE;
+BEGIN;
+SET postgis.enable_outdb_rasters = true;
+SHOW postgis.enable_outdb_rasters;
+ROLLBACK;
+SHOW postgis.enable_outdb_rasters;
+SET ROLE outdb_guc_regression_guest;
+SELECT 'rollback_metadata', outdb_guc_can_read_metadata(rast)
+FROM raster_outdb_template WHERE rid = 1;
+SELECT 'rollback_pixel', outdb_guc_can_read_pixel(rast)
+FROM raster_outdb_template WHERE rid = 1;
+
+RESET ROLE;
+SET postgis.enable_outdb_rasters = true;
+REVOKE SELECT ON raster_outdb_template FROM outdb_guc_regression_guest;
+REVOKE EXECUTE ON FUNCTION outdb_guc_can_read_metadata(raster) FROM outdb_guc_regression_guest;
+REVOKE EXECUTE ON FUNCTION outdb_guc_can_read_pixel(raster) FROM outdb_guc_regression_guest;
+DROP FUNCTION outdb_guc_can_read_metadata(raster);
+DROP FUNCTION outdb_guc_can_read_pixel(raster);
+DROP ROLE outdb_guc_regression_guest;
diff --git a/raster/test/regress/rt_outdb_guc_expected b/raster/test/regress/rt_outdb_guc_expected
new file mode 100644
index 000000000..dac34286f
--- /dev/null
+++ b/raster/test/regress/rt_outdb_guc_expected
@@ -0,0 +1,13 @@
+off
+off_metadata|f
+off_pixel|f
+off_indb_pixel|t
+on_metadata|t
+on_pixel|t
+off
+reset_metadata|f
+reset_pixel|f
+on
+off
+rollback_metadata|f
+rollback_pixel|f
diff --git a/raster/test/regress/tests.mk.in b/raster/test/regress/tests.mk.in
index 59fa11eab..eb614dcf7 100644
--- a/raster/test/regress/tests.mk.in
+++ b/raster/test/regress/tests.mk.in
@@ -22,7 +22,8 @@ override RUNTESTFLAGS_INTERNAL := \
RASTER_TEST_FIRST = \
$(top_srcdir)/raster/test/regress/check_gdal \
- $(top_srcdir)/raster/test/regress/loader/load_outdb
+ $(top_srcdir)/raster/test/regress/loader/load_outdb \
+ $(top_srcdir)/raster/test/regress/rt_outdb_guc
RASTER_TEST_LAST = \
$(top_srcdir)/raster/test/regress/clean
-----------------------------------------------------------------------
Summary of changes:
NEWS | 4 ++
raster/rt_pg/rtpostgis.c | 3 +-
raster/test/regress/rt_outdb_guc.sql | 88 +++++++++++++++++++++++++++++++
raster/test/regress/rt_outdb_guc_expected | 13 +++++
raster/test/regress/tests.mk.in | 3 +-
5 files changed, 109 insertions(+), 2 deletions(-)
create mode 100644 raster/test/regress/rt_outdb_guc.sql
create mode 100644 raster/test/regress/rt_outdb_guc_expected
hooks/post-receive
--
PostGIS
More information about the postgis-tickets
mailing list