Date: Wed, 28 Sep 2022 13:05:53 -0400
From: Bruce Momjian <bruce@momjian.us>
To: Noah Misch <noah@leadboat.com>
Cc: Peter Eisentraut <peter.eisentraut@enterprisedb.com>,
	Tom Lane <tgl@sss.pgh.pa.us>,
	Erki Eessaar <erki.eessaar@taltech.ee>,
	"pgsql-docs@lists.postgresql.org" <pgsql-docs@lists.postgresql.org>
Subject: Re: SQL-standard function bodies and creating SECURITY DEFINER
 routines securely
Message-ID: <YzR+8dBn/9Yk8aYR@momjian.us>
References: 
 <AM9PR01MB8268BF5E74E119828251FD34FE409@AM9PR01MB8268.eurprd01.prod.exchangelabs.com>
 <Yvvw1JB/Y12HvAYn@momjian.us>
 <1408823.1660678462@sss.pgh.pa.us>
 <YvvyJTmSbPLKUm5k@momjian.us>
 <YxAG2DFuSVDcQMn9@momjian.us>
 <a2dc9de4-24fc-3222-87d3-0def8057d7d8@enterprisedb.com>
 <20220912044647.GA1404410@rfd.leadboat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20220912044647.GA1404410@rfd.leadboat.com>
Archived-At: 
 <https://www.postgresql.org/message-id/YzR%2B8dBn/9Yk8aYR%40momjian.us>
Precedence: bulk

On Sun, Sep 11, 2022 at 09:46:47PM -0700, Noah Misch wrote:
> On Thu, Sep 08, 2022 at 01:20:31PM +0200, Peter Eisentraut wrote:
> > On 01.09.22 03:11, Bruce Momjian wrote:
> > >On Tue, Aug 16, 2022 at 03:38:13PM -0400, Bruce Momjian wrote:
> > >>On Tue, Aug 16, 2022 at 03:34:22PM -0400, Tom Lane wrote:
> > >>>Bruce Momjian <bruce@momjian.us> writes:
> > >>>>I have written the attached patch to mention this issue about sql_body
> > >>>>functions.
> > >>>
> > >>>Spell-check, please.  Seems OK otherwise.
> 
> > >Patch applied back to PG 10.  Thanks.
> > 
> > This feature is new in PG 14, so backpatching further than that doesn't make
> > sense.
> 
> Even an sql_body function should override search_path, because it may call
> other code that reacts to search_path.  Separately, the new sentence is near
> the start of a section that addresses more than just search_path.  The section
> ends with the "revoke the default PUBLIC privileges" topic, which is no less
> relevant to sql_body functions.
> 
> Documentation needn't explain cases that make a best practice optional, and it
> should explain only valuable ones.  Omitting search_path on sql_body SECURITY
> DEFINER functions isn't that valuable.  If it were valuable, the patch's
> sentence gives too little detail for the reader to decide what's safe for a
> given function.  I think this section should not attempt such detail.  It's
> enough to give the best practice, as the documentation did before this change.

Agreed, patch reverted in all branches.  Thanks for the feedback.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  Indecision is a decision.  Inaction is an action.  Mark Batterson