gitops/patroni
1
0
Fork 0
mirror of https://github.com/outbackdingo/patroni.git synced 2026-08-25 14:53:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Prevent pg_stat_statements from recording secrets (#2491)

Browse Source 
pg_stat_statements is enabled by many by default, but will by default also track utility commands including an

        ALTER USER john WITH PASSWORD 's3cret'

We can prevent this leaking by ensuring that our session currently does not track utility commands when running a sensitive query.

Local testing shows that this command works fine, even for those that do not have `pg_stat_statements` configured in their
`shared_preload_libraries`.
This commit is contained in:
Feike Steenbergen
2022-12-16 11:25:22 +01:00
committed by GitHub
parent c152bf319d
commit b6b220dddb
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
patroni/postgresql/bootstrap.py
+2
View File
@@ -315,12 +315,14 @@ END;$$""".format(quote_literal(name), quote_ident(name, self._postgresql.connect
self._postgresql.query('SET log_statement TO none')
self._postgresql.query('SET log_min_duration_statement TO -1')
self._postgresql.query("SET log_min_error_statement TO 'log'")
self._postgresql.query("SET pg_stat_statements.track_utility to 'off'")
try:
self._postgresql.query(sql)
finally:
self._postgresql.query('RESET log_min_error_statement')
self._postgresql.query('RESET log_min_duration_statement')
self._postgresql.query('RESET log_statement')
self._postgresql.query('RESET pg_stat_statements.track_utility')
def post_bootstrap(self, config, task):
try: