Jan Wieck <janwieck@Yahoo.com> writes:
> the new EXECUTE command in PL/pgSQL is a security hole.
> PL/pgSQL is a trusted procedural language, meaning that
> regular users can write code in it. With the new EXECUTE
> command, someone could read and write arbitrary files under
> the postgres UNIX-userid using the COPY command.
Huh? This would only be true if all operations inside plpgsql are
executed as superuser, which they are not. Seems to me the existing
defense against non-superuser using COPY is sufficient.
regards, tom lane
