Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1qK3XT-0003Lb-Ha for pgsql-hackers@arkaria.postgresql.org; Thu, 13 Jul 2023 21:07:51 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1qK3XS-0002RE-Cw for pgsql-hackers@arkaria.postgresql.org; Thu, 13 Jul 2023 21:07:50 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1qK3XS-0002P0-2l for pgsql-hackers@lists.postgresql.org; Thu, 13 Jul 2023 21:07:50 +0000 Received: from mail-oa1-x36.google.com ([2001:4860:4864:20::36]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1qK3XM-000FnZ-O0 for pgsql-hackers@postgresql.org; Thu, 13 Jul 2023 21:07:48 +0000 Received: by mail-oa1-x36.google.com with SMTP id 586e51a60fabf-1b0249f1322so889146fac.3 for ; Thu, 13 Jul 2023 14:07:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1689282465; x=1691874465; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=gCT2hwHRcLMGWhwJyV970zDi7k0ALHNHd8gOe/ZDCNs=; b=g/TQJIf6o0uWID+mkWGyL0K6g5M1iwLpj30k2hr5hOvRwzD5IoI6C8N2Y2i32WQXeE p4w06wtNOjPQICORBIZN3uH2IMU4u6E+1gZPvEKvZ6+e8MrA1tpAxAi6e0mLFH+UujJS KODHWiP/oarkiQ/FTqipZ0V9Ddguzuka2ab6RcO+vuAkCu8G1lNEC/sKYWhE3NsjZmHv RCwNyChsleQZ5ZpPijN2RFddQADESJzP/ecZeb6LZ5hGNrE92izQIM4nGWJ7cRljeA6s VdHCFpBrL/aC/lnF7FtPSJDu5l9bvJcJf5P8WViMiFYfVMp8IzSd1ge28+0nBQPGtz/2 xIJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1689282465; x=1691874465; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=gCT2hwHRcLMGWhwJyV970zDi7k0ALHNHd8gOe/ZDCNs=; b=PojOnikBI2lgHZ1uyu09D8B5Y4DSq5Uf9RJ8HLHTvkt1PA8kkiLukiCJlZjc01asM+ hErv2CNDlNtwZcIsr/PouZwzcXtinXe2tMp5HaCYu3ZRaN2KMipToydU34eIcJ3oiP2q cSnxQZJKIII4z7Y2pkj6oZoBTW4qadGTvd+xm8AZ4yargn6Vvc2EDqrHZwC7+dcGsJ9O ZB0pDAmfxGJ1jo8VoUTRWjAPp1PJqpFBVHNyrniPX0CMZKt8CzZzW2GO6y82n1P3FgPD LKsgQIgMgOF9alzPuY5TCnvYnFzAnX5dbxI3SGuCepLTNcWNHcYig/KG0meF8h+BDuw+ 8XOg== X-Gm-Message-State: ABy/qLZR+p242zS4cNr8U3Uwvg70n1Q17hq3mG/k5hUBRwi1sWdS55+A /L29a4u5qsTs9myYWCEAwYaBroiy1ueSQinBeuQ= X-Google-Smtp-Source: APBJJlEeJEHbjIsvjTvglzjqIacLugOmkoHcwjCxRMHPNqmduxY8oSuwda1BQFQyoT3TvBZkDlxvLXQ81r/5QJ7W+F0= X-Received: by 2002:a05:6870:a714:b0:1ad:2c77:57a9 with SMTP id g20-20020a056870a71400b001ad2c7757a9mr3519865oam.38.1689282464873; Thu, 13 Jul 2023 14:07:44 -0700 (PDT) MIME-Version: 1.0 References: <2cf41c8edeaaf7acb757095e6eceab8ae926f3da.camel@j-davis.com> In-Reply-To: From: "David G. Johnston" Date: Thu, 13 Jul 2023 14:07:27 -0700 Message-ID: Subject: Re: Fix search_path for all maintenance commands To: Gurjeet Singh Cc: Jeff Davis , pgsql-hackers@postgresql.org, Nathan Bossart , Robert Haas , Noah Misch , Greg Stark , Tom Lane Content-Type: multipart/alternative; boundary="0000000000003e8042060064b9c4" List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --0000000000003e8042060064b9c4 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Jul 13, 2023 at 2:00=E2=80=AFPM Gurjeet Singh wr= ote: > On Thu, Jul 13, 2023 at 1:37=E2=80=AFPM David G. Johnston > wrote: > > > > I'm against simply breaking the past without any recourse as what we > did for pg_dump/pg_restore still bothers me. > > I'm sure this is tangential, but can you please provide some > context/links to the change you're referring to here. > > Here is the instigating issue and a discussion thread on the aftermath: https://wiki.postgresql.org/wiki/A_Guide_to_CVE-2018-1058%3A_Protect_Your_S= earch_Path https://www.postgresql.org/message-id/flat/13033.1531517020%40sss.pgh.pa.us= #2aa2e25816d899d62f168926e3ff17b1 David J. --0000000000003e8042060064b9c4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, Jul 13, 2023 at 2:00=E2=80=AFPM Gurjeet Singh <= gurjeet@singh.im> wrote:<= br>
On Thu, Jul 13, 2023 at 1:37=E2=80=AFPM David G. Johnston<= br> <david.g= .johnston@gmail.com> wrote:
>
>=C2=A0 I'm against simply breaking the past without any recourse as= what we did for pg_dump/pg_restore still bothers me.

I'm sure this is tangential, but can you please provide some
context/links to the change you're referring to here.


Here is the instigating issue and a discussion th= read on the aftermath:

https://wik= i.postgresql.org/wiki/A_Guide_to_CVE-2018-1058%3A_Protect_Your_Search_Path<= /a>

http= s://www.postgresql.org/message-id/flat/13033.1531517020%40sss.pgh.pa.us#2aa= 2e25816d899d62f168926e3ff17b1

David J.
<= /div>
--0000000000003e8042060064b9c4--