Re: lower() and unaccent() not leakproof - Mailing list pgsql-general

From Tom Lane
Subject Re: lower() and unaccent() not leakproof
Date
Msg-id 673096.1630006990@sss.pgh.pa.us
Whole thread Raw
In response to Re: lower() and unaccent() not leakproof  (Peter Eisentraut <peter.eisentraut@enterprisedb.com>)
List pgsql-general
Peter Eisentraut <peter.eisentraut@enterprisedb.com> writes:
> I think the complexity of the implementation of upper() and lower() is 
> on the same order as bttextcmp() and similar, so it wouldn't be totally 
> out of scope.

True.  But you'll recall that the decision to mark bttextcmp() and
cohorts as leakproof was not made without fear.  IMV, that decision
did not rest simply on code review but on two arguments about why
we should take the risk:

* The query-optimization usefulness of having those be leakproof
is extremely high.

* btree comparison functions should really not have any user-reachable
failure modes (which comes close to being the definition of leakproof).
If one did, that would mean there were legal values of the type that
couldn't be put into a btree index.

Maybe similar arguments can be made about upper/lower, but I think
it's a far weaker case.  As for unaccent, the fact that it relies
on user-controllable definitions seems to me to make it almost
certainly unsafe to be leakproof.

            regards, tom lane



pgsql-general by date:

Previous
From: hubert depesz lubaczewski
Date:
Subject: Re: Can we get rid of repeated queries from pg_dump?
Next
From: Ninad Shah
Date:
Subject: Re: Manual failover cluster