From: Noah Misch <noah@leadboat.com>
To: Bruce Momjian <bruce@momjian.us>
To: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Erki Eessaar <erki.eessaar@taltech.ee>
Cc: pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>
Subject: Re: SQL-standard function bodies and creating SECURITY DEFINER routines securely
Date: Sun, 11 Sep 2022 21:46:47 -0700
Message-ID: <20220912044647.GA1404410@rfd.leadboat.com> (raw)
In-Reply-To: <a2dc9de4-24fc-3222-87d3-0def8057d7d8@enterprisedb.com>
References: <AM9PR01MB8268BF5E74E119828251FD34FE409@AM9PR01MB8268.eurprd01.prod.exchangelabs.com>
<Yvvw1JB/Y12HvAYn@momjian.us>
<1408823.1660678462@sss.pgh.pa.us>
<YvvyJTmSbPLKUm5k@momjian.us>
<YxAG2DFuSVDcQMn9@momjian.us>
<a2dc9de4-24fc-3222-87d3-0def8057d7d8@enterprisedb.com>
On Thu, Sep 08, 2022 at 01:20:31PM +0200, Peter Eisentraut wrote:
> On 01.09.22 03:11, Bruce Momjian wrote:
> >On Tue, Aug 16, 2022 at 03:38:13PM -0400, Bruce Momjian wrote:
> >>On Tue, Aug 16, 2022 at 03:34:22PM -0400, Tom Lane wrote:
> >>>Bruce Momjian <bruce@momjian.us> writes:
> >>>>I have written the attached patch to mention this issue about sql_body
> >>>>functions.
> >>>
> >>>Spell-check, please. Seems OK otherwise.
> >Patch applied back to PG 10. Thanks.
>
> This feature is new in PG 14, so backpatching further than that doesn't make
> sense.
Even an sql_body function should override search_path, because it may call
other code that reacts to search_path. Separately, the new sentence is near
the start of a section that addresses more than just search_path. The section
ends with the "revoke the default PUBLIC privileges" topic, which is no less
relevant to sql_body functions.
Documentation needn't explain cases that make a best practice optional, and it
should explain only valuable ones. Omitting search_path on sql_body SECURITY
DEFINER functions isn't that valuable. If it were valuable, the patch's
sentence gives too little detail for the reader to decide what's safe for a
given function. I think this section should not attempt such detail. It's
enough to give the best practice, as the documentation did before this change.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: noah@leadboat.com, bruce@momjian.us, peter.eisentraut@enterprisedb.com, tgl@sss.pgh.pa.us, erki.eessaar@taltech.ee, pgsql-docs@lists.postgresql.org
Subject: Re: SQL-standard function bodies and creating SECURITY DEFINER routines securely
In-Reply-To: <20220912044647.GA1404410@rfd.leadboat.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox