puppetlabs / puppetlabs/puppetlabs-postgresql

postgresql::server::default_privileges does not quote role name correctly, leading to faulty SQL query in the "unless" clause

Open Beginner friendly
#1,665 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Ruby
Stars
232
Forks
610
Avg merge
5d 23h
Merged PRs (30d)
4

Description

Describe the Bug

The postgresql::server::default_privileges defined type does not quote the role name, leading to a faulty SQL query for the unless clause when the role name contains a hyphen. This makes the ALTER DEFAULT PRIVILEGES grant fail with a Postgres error message like this, when the role name is something like monitoring-role:

Could not evaluate: Error evaluating 'unless' clause, returned pid 891642 exit 1: 'ERROR:  unrecognized key word: "monitoring"
LINE 1: ...amespace AS n ON da.defaclnamespace = n.oid WHERE 'monitori...
                                                             ^
HINT:  ACL key word must be "group" or "user".
'

Expected Behavior

The unless clause should quote the role name in the SQL query and not depend on the name being an SQL-compatible bare identifier. This module takes great care of quoting such role or database names throughout the many SQL commands it constructs, but this seems to have been missed.

I will submit a PR to fix.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the postgresql::server::default_privileges defined type and inspect the SQL used by its unless clause, comparing it with the module's existing quoting for role and database names. Reproduce the case with a role containing a hyphen, then verify that the ALTER DEFAULT PRIVILEGES check produces valid SQL and no longer fails with the PostgreSQL ACL error.

Written by the indexing model from the issue text.

Assessment

Tech stack
postgresql
Domain
databases
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.