From: Tom Lane <tgl@sss.pgh.pa.us>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Use @extschema:name@ notation in contrib transform modules.
Date: Thu, 09 Jan 2025 20:17:04 +0000
Message-ID: <E1tVyxk-000iT3-8r@gemulon.postgresql.org> (raw)
Use @extschema:name@ notation in contrib transform modules.
Harden hstore_plperl, hstore_plpython, and ltree_plpython
against search-path-based attacks by using @extschema:name@
notation to refer to the underlying hstore or ltree data type.
This allows removal of the previous documentation warning
suggesting that they must be installed in the same schema as
the underlying data type. In passing, also improve a para in
extend.sgml to suggest using @extschema:name@ for such purposes.
Discussion: https://postgr.es/m/692480.1736021695@sss.pgh.pa.us
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/bebe9040388bb2292585eab712fe4d29a71843fb
Modified Files
--------------
contrib/hstore_plperl/hstore_plperl--1.0.sql | 4 ++--
contrib/hstore_plperl/hstore_plperlu--1.0.sql | 4 ++--
contrib/hstore_plpython/hstore_plpython3u--1.0.sql | 6 +++---
contrib/ltree_plpython/ltree_plpython3u--1.0.sql | 2 +-
doc/src/sgml/extend.sgml | 14 +++++---------
doc/src/sgml/hstore.sgml | 9 ---------
doc/src/sgml/ltree.sgml | 9 ---------
7 files changed, 13 insertions(+), 35 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: tgl@sss.pgh.pa.us, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Use @extschema:name@ notation in contrib transform modules.
In-Reply-To: <E1tVyxk-000iT3-8r@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox