Reproduced on current master. The tab-completion query for "ALTER DATABASE ... RESET" (Query_for_list_of_database_vars) references pg_db_role_setting and pg_database without a pg_catalog qualification, so a same-named table earlier in search_path shadows the catalog:
CREATE SCHEMA attacker; CREATE TABLE attacker.pg_db_role_setting (setdatabase oid, setrole oid, setconfig text[]); INSERT INTO attacker.pg_db_role_setting SELECT oid, 0, ARRAY['evil_var=x'] FROM pg_database WHERE datname = 'postgres'; SET search_path = attacker, pg_catalog; -- "ALTER DATABASE postgres RESET <TAB>" then offers evil_var
Preventing this makes sense in case somebody accidentally misconfigured their server. Which is not very probable for a table with `pg_db_role_setting` name.
If untrusted users have access to a database that has not adopted a secure schema usage pattern, begin your session by removing publicly-writable schemas from search_path.
