From: Tom Lane <tgl@sss.pgh.pa.us>
To: Michael Paquier <michael.paquier@gmail.com>
cc: Joe Conway <mail@joeconway.com>,
        PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Subject: Re: Incautious handling of overlength identifiers
In-reply-to: <6481.1482771955@sss.pgh.pa.us>
References: <17691.1482523168@sss.pgh.pa.us> <20641.1482525852@sss.pgh.pa.us>
 <ed23895f-c3b5-e42c-7a79-c676378c34da@joeconway.com>
 <CAB7nPqRa4O0a93kaKaropQqYG283OA5BabRoCS=oGQn16xFTEA@mail.gmail.com>
 <6481.1482771955@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Mon, 26 Dec 2016 12:05:55 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <7095.1482773527.1@sss.pgh.pa.us>
Date: Mon, 26 Dec 2016 12:32:07 -0500
Message-ID: <7096.1482773527@sss.pgh.pa.us>
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

I wrote:
> Another idea worth considering is to just make the low-level functions
> do truncation ...

After further thought, there's a bigger-picture issue here, which
is whether the inputs to the SQL functions in question are intended to
be raw user input --- in which case, not only would truncation be
an appropriate service, but probably so would downcasing --- or whether
they are more likely to be coming from a catalog scan, in which case
you don't want any of that stuff.  Nobody's going to be happy if we
start making them add quote_ident() around references to name columns.
I think the privilege-inquiry functions are almost certainly mostly
used in the latter style; there might be more room for debate about,
say, pg_get_serial_sequence.

Since the low-level functions need to support both use cases, asking
them to handle truncation is wrong, just as much as it would be to
ask them to do downcasing.

If we take these SQL functions as being meant for use with inputs
coming from catalogs, then they don't need to do truncation for
user-friendliness purposes; it's perfectly fine to treat overlength
inputs as "name not found" cases.  So that says we could just remove
that Assert and decide we're done.

			regards, tom lane


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers