Robert Haas escribió:
> On Wed, Mar 27, 2013 at 10:16 AM, Heikki Linnakangas
> <hlinnakangas@vmware.com> wrote:
> > I'm quite worried about the security ramifications of this patch. Today, if
> > you're not sure if a system has e.g sslinfo installed, you can safely just
> > run "CREATE EXTENSION sslinfo". With this patch, that's no longer true,
> > because "foo" might not be the extension you're looking for. Mallory
> > might've done this:
> >
> > create template for extension sslinfo version '1.0' with (schema public) as
> > $$ DO EVIL STUFF $$;
>
> Surely creating an extension template must be a superuser-only
> operation, in which case this is an issue because Mallory could also
> have just blown up the world directly if he's already a superuser
> anyway.
Yeah .. (except "this is NOT an issue")
> If the current patch isn't enforcing that, it's 100% broken.
Even if it's not enforcing that, it's not 100% broken, it only contains
one more bug we need to fix.
--
Álvaro Herrera http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services
