pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Greg Sabino Mullane <htamfids@gmail.com>
Cc: Andres Freund <andres@anarazel.de>
Cc: Antonin Houska <ah@cybertec.at>
Cc: pgsql-hackers@lists.postgresql.org <pgsql-hackers@lists.postgresql.org>
Subject: Re: POC: Carefully exposing information without authentication
Date: Wed, 16 Sep 2026 10:20:57 -0400
Message-ID: <496975.1789568457@sss.pgh.pa.us> (raw)
In-Reply-To: <53ACCD31-34FD-4D36-A60E-8FF62023FA0A@yesql.se>
References: <CAKAnmm+T-CEDLmRezWfH-7ZEsFfD_kU2KY1TgB288K+wprB_4Q@mail.gmail.com>
	<21076.1748617331@localhost>
	<CAKAnmmJ77jeYZGXPBxb75U52ojNRUoKd6Za-T26xNPCouUeV8g@mail.gmail.com>
	<2724612.1748655287@sss.pgh.pa.us>
	<CAKAnmm+RQbLFv1F35ZTRZfMRigwN0LN0KKRocLLpwSshBTZxvg@mail.gmail.com>
	<CAKAnmmLdrvdCMbAQbfiWY3q=zv+-11zZk+jweTRVCJrNL=aD4A@mail.gmail.com>
	<CAKAnmmKxP7bOO7QOLdSk8dYoUxFRus2XC1nEbk6En9GgV_4JbA@mail.gmail.com>
	<11894.1767966998@localhost>
	<CAKAnmm+-+2aZiK-wtwSCEpfOJbU7-PnwofByhr0F_XQB4wUJNw@mail.gmail.com>
	<CAKAnmmJUGidY7cjD0rHtNVisQksy3u1KszHXkMCNPWYhMKPEvw@mail.gmail.com>
	<sqammd2ykcy34skbsewpfq4ftm6xl3qt5ebr2plwenoprtvdrm@ayddy4xqbkb5>
	<CAKAnmmKxDD41mrnbM29+5d+OBrPRBr3N=T+LGxUcAKoG5JkM5A@mail.gmail.com>
	<CAKAnmm+eGs++amVMuq-dGXzUOHRNytHgMcaX_5N+jvitmBn6MA@mail.gmail.com>
	<CAKAnmmJBhwNK-vBgRJ0EgBVe_2dLomKOGtt=OLFbkA1Kd1eFjA@mail.gmail.com>
	<53ACCD31-34FD-4D36-A60E-8FF62023FA0A@yesql.se>

Daniel Gustafsson <daniel@yesql.se> writes:
> To be honest, I am absolutely terrified by any feature which does any level of
> work based on user input before authentication or authorization.

Yeah.  TBH, I can't see this ever getting committed.

			regards, tom lane






view thread (18+ messages)  latest in thread

Message-ID: <496975.1789568457@sss.pgh.pa.us>
Permalink:  ../496975.1789568457@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/496975.1789568457@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: tgl@sss.pgh.pa.us, daniel@yesql.se, htamfids@gmail.com, andres@anarazel.de, ah@cybertec.at, pgsql-hackers@lists.postgresql.org
  Subject: Re: POC: Carefully exposing information without authentication
  In-Reply-To: <496975.1789568457@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox