Date: Wed, 10 Jun 2026 06:16:36 +0000
From: Bertrand Drouvot <bertranddrouvot.pg@gmail.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Michael Paquier <michael@paquier.xyz>, Chao Li <li.evan.chao@gmail.com>,
	Postgres hackers <pgsql-hackers@lists.postgresql.org>,
	Fujii Masao <masao.fujii@gmail.com>,
	Peter Eisentraut <peter@eisentraut.org>,
	Jeff Davis <pgsql@j-davis.com>,
	Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>,
	Amit Kapila <amit.kapila16@gmail.com>
Subject: Re: Fix unqualified catalog references in psql describe queries
Message-ID: <aikBRL/Tws2vmIjI@bdtpg>
References: <C809E3C7-2437-486E-B626-0BE5F40BBB6C@gmail.com>
 <aie76hpKavQ9nAqd@paquier.xyz>
 <aifYIhmiqNr9mf6f@bdtpg>
 <aijEfGcHUJvqjzNj@paquier.xyz>
 <1236173.1781057568@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1236173.1781057568@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/aikBRL/Tws2vmIjI%40bdtpg>
Precedence: bulk

Hi,

On Tue, Jun 09, 2026 at 10:12:48PM -0400, Tom Lane wrote:
> Michael Paquier <michael@paquier.xyz> writes:
> > On Tue, Jun 09, 2026 at 09:08:50AM +0000, Bertrand Drouvot wrote:
> >> Now I wonder if we shoud not "protect" the operators too. They could also
> >> lead to wrong results (if not worst).
> 
> > Kind of true.  Still we have been pretty lax about the operators as
> > they also lead to less readable queries.
> 
> We disclaimed security against odd search_paths for these queries long ago,
> precisely because wrapping every operator in PG_OPERATOR(pg_catalog.*)
> would be far too tedious and destructive of readability --- not to
> mention that there are some syntaxes such as IN that don't even offer
> the option to do that.

I do agree that doing so would "destroy" the readability. I did not look in detail,
but what about forcing ALWAYS_SECURE_SEARCH_PATH_SQL before the queries and
restore the search_path once the query is done? (that way that would not impact
the readability)

Regards,

-- 
Bertrand Drouvot
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com