Date: Fri, 21 Oct 2005 14:51:16 -0600
From: Michael Fuhr <mike@fuhr.org>
To: Bob <luckyratfoot@gmail.com>
Cc: pgsql-docs@postgresql.org
Subject: Re: Minor changed needed to doc on untrusted pl/perl example
Message-ID: <20051021205116.GA9396@winnie.fuhr.org>
References: <762e5c0510211106m12896b11t5d6ab62865620b5d@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <762e5c0510211106m12896b11t5d6ab62865620b5d@mail.gmail.com>

On Fri, Oct 21, 2005 at 01:06:05PM -0500, Bob wrote:
> CREATE FUNCTION badfunc() RETURNS integer AS $$
>     open(TEMP, ">/tmp/badfile");
>     print TEMP "Gotcha!\n";
>     return 1;
> $$ LANGUAGE plperl;
> 
> I believe the code snippet should look like this for it to work correctly:
> 
> CREATE FUNCTION badfunc() RETURNS integer AS $$
>     open(TEMP, ">/tmp/badfile");
>     print TEMP "Gotcha!\n";
>     close(TEMP);
>     return 1;
> $$ LANGUAGE plperl;

The function should work without an explicit close (or it would,
but for the security check).  The file should appear on disk
immediately after the open, although the data might not be flushed
to disk until the file is actually closed, such as when the calling
session's postmaster exits (that's how a plperlu version behaves
on my test system, anyway).  Not that I disagree with adding an
explicit close, but the example should still "work" without it.

-- 
Michael Fuhr