Obstruct EXTRACT() field name deparse injection (CVE-2026-15741)

[xuhuicai]

Port the CVE-2026-15741 fix (PostgreSQL 18.6, 2026-08-13 security release) to IvorySQL master. Closes #1791.

Upstream commit f9729b5078d ported verbatim ("Obstruct EXTRACT()
field name deparse injection").

Summary: the parser accepts any string literal as an EXTRACT() field
name; get_func_sql_syntax() deparsed it without quoting, so unusual
field names changed meaning on pg_dump restore or injected unintended
SQL. The fix quotes the field name with quote_identifier().

Notes:

• ruleutils.c is not touched by IvorySQL-specific code here; no oracle
  changes needed.
• Verified: make check 249/249; pg_get_viewdef() now renders
  EXTRACT("weird field name" FROM ...).

Assisted-by: Cursor

Summary by CodeRabbit

• Bug Fixes
  • Improved SQL generation for EXTRACT expressions by correctly quoting date/time field names.
  • Preserved valid syntax for IS ... NORMALIZED expressions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 71b4db63-4701-44c1-9409-64bab0aece32

📥 Commits

Reviewing files that changed from the base of the PR and between 5beb990 and cbdbc49.

📒 Files selected for processing (1)

• src/backend/utils/adt/ruleutils.c

Included review availability: Your plan provides up to 4 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The EXTRACT deparsing path now quotes field names with quote_identifier(). A comment documents the unchanged raw handling of safe IS ... NORMALIZED field words.

Changes

EXTRACT deparsing

Layer / File(s)	Summary
Quote EXTRACT field names src/backend/utils/adt/ruleutils.c	get_func_sql_syntax() now passes the EXTRACT field name to quote_identifier(). A comment documents the safe raw append for IS ... NORMALIZED field words.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to cbdbc

The change safely quotes unusual EXTRACT() field names during deparsing to preserve correct SQL meaning on restore; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the EXTRACT() field-name deparse injection fix and includes the related CVE.
Linked Issues check	✅ Passed	The change quotes EXTRACT() field names with quote_identifier(), which directly addresses issue #1791 and prevents altered or injectable SQL during deparsing and pg_dump restoration.
Out of Scope Changes check	✅ Passed	The pull request changes only the relevant EXTRACT() deparsing logic and adds a related clarification comment. No unrelated code changes are present.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}