From: ljb <lbayuk@mindspring.com>
To: pgsql-interfaces@postgresql.org
Subject: Is PQfn() insecure or not?
Date: Wed, 1 Jan 2003 00:40:31 +0000 (UTC)
Message-ID: <autddu$2uri$1@news.hub.org> (raw)
"Programmer's Guide, Client Interfaces, libpq, The Fast-Path Interface"
describes PQfn() and has this alarming remark:
"This is a trapdoor into system internals and can be a potential
security hole."
Sure this isn't true. PQfn() just lets a frontend call a function which is
also accessible (if maybe not useful) via a SELECT statement, correct? If
I'm right, we should remove the scary language from the documentation. If
on the other hand PQfn() is a security hole, could someone post an exploit?
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: lbayuk@mindspring.com
Subject: Re: Is PQfn() insecure or not?
In-Reply-To: <autddu$2uri$1@news.hub.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox