From: Chao Li <li.evan.chao@gmail.com>
Content-Type: text/plain;
	charset=utf-8
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.400.21\))
Subject: Avoid leaking system path from pg_available_extensions
Message-Id: <357C774A-ECE9-4455-B641-315205D4D9A1@gmail.com>
Date: Wed, 20 May 2026 09:00:29 +0800
Cc: Andrew Dunstan <andrew@dunslane.net>,
 Matheus Alcantara <matheusssilv97@gmail.com>
To: PostgreSQL-development <pgsql-hackers@postgresql.org>
Archived-At: 
 <https://www.postgresql.org/message-id/357C774A-ECE9-4455-B641-315205D4D9A1%40gmail.com>
Precedence: bulk

Hi,

I just tested =E2=80=9CAdd paths of extensions to =
pg_available_extensions=E2=80=9D, and found an issue.

This is a simple repro:
```
evantest=3D# reset extension_control_path;
RESET
evantest=3D# select * from pg_available_extensions where name =3D =
'plpgsql';
  name   | default_version | installed_version | location |           =
comment
=
---------+-----------------+-------------------+----------+---------------=
---------------
 plpgsql | 1.0             | 1.0               | $system  | PL/pgSQL =
procedural language
(1 row)

evantest=3D# set extension_control_path=3D'';
SET
evantest=3D# select * from pg_available_extensions where name =3D =
'plpgsql';
  name   | default_version | installed_version |             location    =
         |           comment
=
---------+-----------------+-------------------+--------------------------=
--------+------------------------------
 plpgsql | 1.0             | 1.0               | =
/usr/local/pgsql/share/extension | PL/pgSQL procedural language
(1 row)
```

When extension_control_path is not set, location shows =E2=80=9C$system", =
which is consistent with what the documentation says:
```
       <para>
        The default value for this parameter is
        <literal>'$system'</literal>. If the value is set to an empty
        string, the default <literal>'$system'</literal> is also =
assumed.
       </para>
```

However, as shown above, when I set extension_control_path to an empty =
string, the absolute system path is displayed. I consider this an =
information leakage bug.

The fix is straightforward; see the attached patch for details. After =
the fix, when extension_control_path is an empty string, location shows =
=E2=80=9C$system=E2=80=9D now:
```
evantest=3D# set extension_control_path=3D'';
SET
evantest=3D# select * from pg_available_extensions where name =3D =
'plpgsql';
  name   | default_version | installed_version | location |           =
comment
=
---------+-----------------+-------------------+----------+---------------=
---------------
 plpgsql | 1.0             | 1.0               | $system  | PL/pgSQL =
procedural language
(1 row)
```

Best regards,
--
Chao Li (Evan)
HighGo Software Co., Ltd.
https://www.highgo.com/