Re: [ANNOUNCE] Advisory on possibly insecure security definer functions - Mailing list pgsql-general

From Kenneth Downs
Subject Re: [ANNOUNCE] Advisory on possibly insecure security definer functions
Date
Msg-id 45D389B6.4050505@secdat.com
Whole thread Raw
In response to [ANNOUNCE] Advisory on possibly insecure security definer functions  ("Peter Eisentraut" <peter_e@gmx.net>)
List pgsql-general
Peter Eisentraut wrote:
> The proper fix for this problem is to insert explicit SET search_path
> commands into each affected function to produce a known safe schema
> search path.  Note that using the default search path, which includes a
> reference to the "$user" schema, is not safe when unqualified
> references are intended to be found in the "public" schema and "$user"
> schemas exist or can be created by other users.  It is also not
> recommended to rely on rigorously schema-qualifying all function and
> operator invocations in function source texts, as such measures are
> likely to induce mistakes and will furthermore make the source code
> harder to read and maintain.
>
>


I do enjoy code generators.  This was a one-line fix for me.


Attachment

pgsql-general by date:

Previous
From: "Mikko Partio"
Date:
Subject: Re: Cast record as text
Next
From: "John D. Burger"
Date:
Subject: Re: Recover anything from dropped database?