Three privilege-escalation holes closed, and the PostgreSQL wire corpus from 10 files to 37
Summary: Three privilege-escalation holes closed, and the PostgreSQL wire corpus from 10 files to 37 (v0.6.0b12).
Three ways a caller could reach data its grants didn't cover are now shut.
An aggregation pipeline could sidestep role-based access control outright,
so a user with no read grant on a collection could still read it through
$lookup; a SQL write statement could read tables it held no SELECT grant
on, because only the write target was authorized; and large-object writes
honoured neither RBAC nor read-only transactions. Each is closed with tests
that assert the denial, not just the happy path. The admin UI also stopped
treating collection names as markup — a name containing a script tag is now
escaped wherever it is rendered — and the Rust storage crates moved to PyO3
0.29, clearing two RUSTSEC advisories.
The PostgreSQL wire protocol had its largest single push so far, measured by
running CockroachDB's byte-exact pgtest corpus unmodified: 37 of 64
corpus files now pass, up from 10, with unexpected failures down from 43 to
18. Portals behave like PostgreSQL's — they die at transaction end, refuse
a duplicate name inside a block, block a DROP of a table they still read, and
suspend on exactly their row limit instead of guessing that the data ran out.
GUC reporting follows PG's ordering and spellings, including savepoint-scoped
reverts and the report that accompanies an error. Parameter typing follows
PG's parse analysis, so a placeholder compared against a column takes that
column's type and genuinely unresolvable placeholders are rejected rather than
silently coerced. COPY reached byte-exact CSV fidelity, and jsonpath,
ltree, and PostgreSQL's internal one-byte "char" joined the type system.
Driver-facing depth grew alongside it: BEFORE INSERT row triggers with
plpgsql NEW records, plpgsql refcursors (OPEN … FOR, CLOSE, FETCH by
portal name), set-returning functions in the select list, EXCLUDE
constraints, and a long list of catalog and metadata gaps that pgjdbc's
DatabaseMetaData suite reads. Two measurement fixes are worth naming
because they change what the numbers mean: the pgtest gauge now runs each
corpus file against a fresh server, as upstream does — sharing one server let
debris from an earlier file fail two later ones — and the crash-diagnostic
test harness now recognises a nested run that finished its tests before
hanging in teardown, which had been failing releases on a passing suite.