postgres.git / summary / log / commit / refs

commit    334e508e17da7067d11fca3053b976d7d6f3fb10
Author:   Noah Misch <noah@leadboat.com>
Date:     Thu May 01 23:51:59 2025 +0000
First released in: 18.0, 13.21, 14.18, 15.13, 16.9, 17.5

    Doc: stop implying recommendation of insecure search_path value.
    
    SQL "SET search_path = 'pg_catalog, pg_temp'" is silently equivalent to
    "SET search_path = pg_temp, pg_catalog, "pg_catalog, pg_temp"" instead
    of the intended "SET search_path = pg_catalog, pg_temp".  (The intent
    was a two-element search path.  With the single quotes, it instead
    specifies one element with a comma and a space in the middle of the
    element.)  In addition to the SET statement, this affects SET clauses of
    CREATE FUNCTION, ALTER ROLE, and ALTER DATABASE.  It does not affect the
    set_config() SQL function.
    
    Though the documentation did not show an insecure command, remove single
    quotes that could entice a reader to write an insecure command.
    Back-patch to v13 (all supported versions).
    
    Reported-by: Sven Klemm <sven@timescale.com>
    Author: Sven Klemm <sven@timescale.com>
    Backpatch-through: 13


 doc/src/sgml/extend.sgml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/src/sgml/extend.sgml b/doc/src/sgml/extend.sgml
index 218940ee5ce..4b7094f2739 100644
--- a/doc/src/sgml/extend.sgml
+++ b/doc/src/sgml/extend.sgml
@@ -1339,8 +1339,8 @@ SELECT * FROM pg_extension_update_paths('<replaceable>extension_name</replaceabl
       secure <varname>search_path</varname>; do <emphasis>not</emphasis>
       trust the path provided by <command>CREATE/ALTER EXTENSION</command>
       to be secure.  Best practice is to temporarily
-      set <varname>search_path</varname> to <literal>'pg_catalog,
-      pg_temp'</literal> and insert references to the extension's
+      set <varname>search_path</varname> to <literal>pg_catalog,
+      pg_temp</literal> and insert references to the extension's
       installation schema explicitly where needed.  (This practice might
       also be helpful for creating views.)  Examples can be found in
       the <filename>contrib</filename> modules in


[parent: e14df1015e2c]