From: Tom Lane <tgl@sss.pgh.pa.us>
To: Michael Paquier <michael.paquier@gmail.com>
Cc: Joe Conway <mail@joeconway.com>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Subject: Re: Incautious handling of overlength identifiers
Date: Mon, 26 Dec 2016 12:32:07 -0500
Message-ID: <7096.1482773527@sss.pgh.pa.us> (raw)
In-Reply-To: <6481.1482771955@sss.pgh.pa.us>
References: <17691.1482523168@sss.pgh.pa.us>
<20641.1482525852@sss.pgh.pa.us>
<ed23895f-c3b5-e42c-7a79-c676378c34da@joeconway.com>
<CAB7nPqRa4O0a93kaKaropQqYG283OA5BabRoCS=oGQn16xFTEA@mail.gmail.com>
<6481.1482771955@sss.pgh.pa.us>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
I wrote:
> Another idea worth considering is to just make the low-level functions
> do truncation ...
After further thought, there's a bigger-picture issue here, which
is whether the inputs to the SQL functions in question are intended to
be raw user input --- in which case, not only would truncation be
an appropriate service, but probably so would downcasing --- or whether
they are more likely to be coming from a catalog scan, in which case
you don't want any of that stuff. Nobody's going to be happy if we
start making them add quote_ident() around references to name columns.
I think the privilege-inquiry functions are almost certainly mostly
used in the latter style; there might be more room for debate about,
say, pg_get_serial_sequence.
Since the low-level functions need to support both use cases, asking
them to handle truncation is wrong, just as much as it would be to
ask them to do downcasing.
If we take these SQL functions as being meant for use with inputs
coming from catalogs, then they don't need to do truncation for
user-friendliness purposes; it's perfectly fine to treat overlength
inputs as "name not found" cases. So that says we could just remove
that Assert and decide we're done.
regards, tom lane
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, michael.paquier@gmail.com, mail@joeconway.com
Subject: Re: Incautious handling of overlength identifiers
In-Reply-To: <7096.1482773527@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox