Re: [GENERAL] Security implications of (plpgsql) functions - Mailing list pgsql-hackers

From Robert Treat
Subject Re: [GENERAL] Security implications of (plpgsql) functions
Date
Msg-id 1035224267.3750.10.camel@camel
Whole thread Raw
In response to Re: [GENERAL] Security implications of (plpgsql) functions  (Tom Lane <tgl@sss.pgh.pa.us>)
List pgsql-hackers
I've seen the idea of "user resource limits" bandied about before as a
way to address these problems; depending on implementation that might be
the way to go.

Robert Treat

On Mon, 2002-10-21 at 12:44, Tom Lane wrote:
> Joe Conway <mail@joeconway.com> writes:
> > Is there any way to recognize infinite recursion by analyzing the saved 
> > execution tree -- i.e. can we assume that a function that calls itself, with 
> > the same arguments with which it was called, constitutes infinite recursion?
> 
> A bulletproof solution would be equivalent to solving the halting
> problem, I believe.  The test you mentioned is easily defeated by
> recursing between two functions.  Also, a would-be instigator of
> DOS doesn't need *infinite* recursion; it could be quite finite and
> still blow out your stack.  For example ask for factorial(10million)
> where factorial is defined in the traditional recursive way...
> 
>             regards, tom lane
> 





pgsql-hackers by date:

Previous
From: Larry Rosenman
Date:
Subject: Re: Please help
Next
From: Bruce Momjian
Date:
Subject: Re: autocommit vs TRUNCATE et al