To: Thomas Hallgren <thomas@tada.se>
cc: Kris Jurka <books@ejurka.com>, pljava-dev@pgfoundry.org,
	Alvaro Herrera <alvherre@commandprompt.com>, pgsql-hackers@postgresql.org
Subject: Re: Re: [Pljava-dev] Should creating a new base type require
	superuser status?
In-reply-to: <48937589.10304@tada.se> 
References: <19715.1217447413@sss.pgh.pa.us>
	<20080730220753.GG3977@alvh.no-ip.org>
	<Pine.BSO.4.64.0807311543170.14232@leary.csoft.net>
	<23846.1217539394@sss.pgh.pa.us> <48937589.10304@tada.se>
Comments: In-reply-to Thomas Hallgren <thomas@tada.se>
	message dated "Fri, 01 Aug 2008 22:43:53 +0200"
Date: Fri, 01 Aug 2008 17:42:41 -0400
Message-ID: <23725.1217626961@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>

Thomas Hallgren <thomas@tada.se> writes:
> Tom, could you please elaborate where you see a security hole?

The problem that we've seen in the past shows up when the user lies in
the CREATE TYPE command, specifying type representation properties that
are different from what the underlying functions expect.  In particular,
if it's possible to pass a pass-by-value integer to a function
that's expecting a pass-by-reference datum, you can misuse the function
to access backend memory.

I gather from looking at the example that Kris referenced that there's
some interface code in between the SQL function call and the user's Java
code, and that that interface code is itself looking at the declared
properties of the SQL type to decide what to do.  So to the extent that
that code is (a) bulletproof against inconsistencies and (b) not
subvertible by the PL/Java user, it might be that there's no hole in
practice.  But assumption (b) seems pretty fragile to me.

			regards, tom lane