From: Chapman Flack <chap@anastigmatix.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
To: pgsql-hackers@lists.postgresql.org
Subject: Re: Loose ends after CVE-2020-14350 (extension installation hazards)
Date: Fri, 14 Aug 2020 15:07:51 -0400
Message-ID: <5F36E107.50907@anastigmatix.net> (raw)
In-Reply-To: <653936.1597431032@sss.pgh.pa.us>
References: <653936.1597431032@sss.pgh.pa.us>
On 08/14/20 14:50, Tom Lane wrote:
> SAVEPOINT s1;
> SET LOCAL search_path = pg_catalog, pg_temp;
> ... protected code here ...
> RELEASE SAVEPOINT s1;
>
> but this does not work because SET LOCAL persists to the end of the
> outer transaction. Maybe we could invent a variant that only lasts
> for the current subtransaction.
This reminds me of the way the SQL standard overloads WITH to supply
lexically-scoped settings of things, as well as CTEs, mentioned a while
back. [1]
Would this provide additional incentive to implement that syntax,
generalized to support arbitrary GUCs and not just the handful of
specific settings the standard uses it for?
Regards,
-Chap
[1] https://www.postgresql.org/message-id/5AAEAE0F.20006%40anastigmatix.net
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: chap@anastigmatix.net, tgl@sss.pgh.pa.us, pgsql-hackers@lists.postgresql.org
Subject: Re: Loose ends after CVE-2020-14350 (extension installation hazards)
In-Reply-To: <5F36E107.50907@anastigmatix.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox