Re: Potential security risk associated with function call - Mailing list pgsql-hackers

From Jet
Subject Re: Potential security risk associated with function call
Date
Msg-id tencent_62EB6CDE73ED1FFC4CAD7A3B@qq.com
Whole thread Raw
In response to Re: Potential security risk associated with function call  (Kirill Reshke <reshkekirill@gmail.com>)
List pgsql-hackers
> > > It is the explicit responsibility of
> > > the superuser to make sure the functions they create using untrusted
> > > languages are correct and execute safely when called by PostgreSQL.
> > But the question is how can a superuser know the "internal" and "c" functions
> > implementation details? He will not know whether the code has !PG_ARGISNULL(...),
> > and create a harmful function accidentally...

> I think our global assumption is that superuser is super-wise and
> knows everything

Totally agreed ...

Jet
Halo Tech

pgsql-hackers by date:

Previous
From: Kirill Reshke
Date:
Subject: Re: Potential security risk associated with function call
Next
From: vignesh C
Date:
Subject: Re: Skipping schema changes in publication