From: Tom Lane <tgl@sss.pgh.pa.us>
To: Fujii Masao <masao.fujii@gmail.com>
cc: Chao Li <li.evan.chao@gmail.com>,
        Postgres hackers <pgsql-hackers@lists.postgresql.org>,
        vignesh C <vignesh21@gmail.com>
Subject: Re: Prevent remote libpq notices from being sent to clients
In-reply-to: 
 <CAHGQGwH8De4O1mBZRHWATngQOqCb+1p741DW1rBKgWu2wkfaLw@mail.gmail.com>
References: <396C3BEE-CD4D-450A-8D28-E708E9AA4075@gmail.com>
 <CAHGQGwH8De4O1mBZRHWATngQOqCb+1p741DW1rBKgWu2wkfaLw@mail.gmail.com>
Comments: In-reply-to Fujii Masao <masao.fujii@gmail.com>
	message dated "Fri, 05 Jun 2026 23:28:44 +0900"
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-ID: <3592595.1780670596.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Fri, 05 Jun 2026 10:43:16 -0400
Message-ID: <3592596.1780670596@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/3592596.1780670596%40sss.pgh.pa.us>
Precedence: bulk

Fujii Masao <masao.fujii@gmail.com> writes:
> On Fri, Jun 5, 2026 at 6:32=E2=80=AFPM Chao Li <li.evan.chao@gmail.com> =
wrote:
>> So remote messages should only be output to the server log, but current=
ly they can leak to the client if client_min_messages is set to log.

> I'm not sure whether it's good idea to add this limitation.

I was just about to answer saying that I didn't think so.  I'm
concerned that there might be no other way to obtain such output.
It's likely that the remote server doesn't log NOTICE-level messages,
and even if it does, you might not have access to its log.

Also, I don't buy the argument that this is a "leak": if the remote
server was willing to send the message to its client, it doesn't think
that the message is security-critical.

What I think there might be a good case for is to use the same ereport
level that was used to issue the remote's message, rather than always
LOG level.  I'm not sure if we can reconstruct that completely, but we
can certainly tell NOTICE from WARNING, for instance.

			regards, tom lane