From: Tom Lane <tgl@sss.pgh.pa.us>
To: Michael Paquier <michael@paquier.xyz>
Cc: Ronan Dunklau <ronan.dunklau@aiven.io>
Cc: pgsql-hackers@lists.postgresql.org, Peter Eisentraut <peter.eisentraut@enterprisedb.com>
Subject: Re: Converting contrib SQL functions to new style
Date: Tue, 05 Nov 2024 20:05:16 -0500
Message-ID: <3133933.1730855116@sss.pgh.pa.us> (raw)
In-Reply-To: <Zyq9fXnmc5YiXik_@paquier.xyz>
References: <3395418.1618352794@sss.pgh.pa.us>
<3316564.aeNJFYEL58@aivenlaptop>
<2650823.1730736601@sss.pgh.pa.us>
<1901969.tdWV9SEqCh@aivenlaptop>
<Zyq9fXnmc5YiXik_@paquier.xyz>
Michael Paquier <michael@paquier.xyz> writes:
> I was wondering what was going on here, and this patch comes down to
> switching all these definitions from that:
> CREATE FUNCTION lo_oid(lo) RETURNS pg_catalog.oid AS
> 'SELECT $1::pg_catalog.oid' LANGUAGE SQL STRICT IMMUTABLE PARALLEL SAFE;
> To that:
> +CREATE OR REPLACE FUNCTION lo_oid(lo) RETURNS pg_catalog.oid
> +LANGUAGE SQL STRICT IMMUTABLE PARALLEL SAFE
> +RETURN (SELECT $1::pg_catalog.oid);
Right.
> This makes the executions more robust run-time search_path checks. Is
> that something that should be considered for a backpatch, actually?
No, I don't think so. For one thing, it would not help existing
installations unless they issue "ALTER EXTENSION UPDATE", which
people are not likely to do in a minor update. But also, we don't
know of live attacks against these functions with their current
definitions, so I don't think this is urgent.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, michael@paquier.xyz, ronan.dunklau@aiven.io, peter.eisentraut@enterprisedb.com
Subject: Re: Converting contrib SQL functions to new style
In-Reply-To: <3133933.1730855116@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox