pg.ddx.io pgsql-hackers@postgresql.org mailing list archive
help / color / mirror / Atom feedFrom: Sandro Santilli <strk@kbt.io>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: Regina Obe <lr@pcorp.us>
Cc: PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Support % wildcard in extension upgrade filenames
Date: Sat, 4 Jun 2022 11:21:53 +0200
Message-ID: <YpskMclOjra+0Jzn@c19> (raw)
In-Reply-To: <6181DA3F-B24A-4313-A0C2-F05D690AA726@yesql.se>
References: <YgakFklJyM5pNdt+@c19>
<001d01d87211$edbd5b50$c93811f0$@pcorp.us>
<d3924670ba8fefa42f4bd462c5b7f6349d63f4d3.camel@cybertec.at>
<6181DA3F-B24A-4313-A0C2-F05D690AA726@yesql.se>
On Sat, May 28, 2022 at 05:26:05PM +0200, Daniel Gustafsson wrote:
> > On 28 May 2022, at 16:50, Laurenz Albe <laurenz.albe@cybertec.at> wrote:
>
> > I don't think this idea is fundamentally wrong, but I have two worries:
> >
> > 1. It would be a good idea good to make sure that there is not both
> > "extension--%--2.0.sql" and "extension--1.0--2.0.sql" present.
> > Otherwise the behavior might be indeterministic.
> >
> > 2. What if you have a "postgis--%--3.3.sql", and somebody tries to upgrade
> > their PostGIS 1.1 installation with it? Would that work?
> > Having a lower bound for a matching version might be a good idea,
> > although I have no idea how to do that.
>
> Following that reasoning, couldn't a rogue actor inject a fake file (perhaps
> bundled with another innocent looking extension) which takes precedence in
> wildcard matching?
I think whoever can write into the PostgreSQL extension folder will
be able to inject anything anyway....
--strk;
view thread (78+ messages) latest in thread
Message-ID: <YpskMclOjra+0Jzn@c19>
Permalink: ../YpskMclOjra+0Jzn@c19/
Also on: postgresql.org/message-id/YpskMclOjra+0Jzn@c19
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: strk@kbt.io, daniel@yesql.se, laurenz.albe@cybertec.at, lr@pcorp.us
Subject: Re: [PATCH] Support % wildcard in extension upgrade filenames
In-Reply-To: <YpskMclOjra+0Jzn@c19>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox