To: Thomas Hallgren <thomas@tada.se>
cc: Kris Jurka <books@ejurka.com>, pljava-dev@pgfoundry.org,
	Alvaro Herrera <alvherre@commandprompt.com>, pgsql-hackers@postgresql.org
Subject: Re: Re: [Pljava-dev] Should creating a new base type require
	superuser status?
In-reply-to: <48940239.8080401@tada.se> 
References: <19715.1217447413@sss.pgh.pa.us>
	<20080730220753.GG3977@alvh.no-ip.org>
	<Pine.BSO.4.64.0807311543170.14232@leary.csoft.net>
	<23846.1217539394@sss.pgh.pa.us> <48937589.10304@tada.se>
	<23725.1217626961@sss.pgh.pa.us> <48940239.8080401@tada.se>
Comments: In-reply-to Thomas Hallgren <thomas@tada.se>
	message dated "Sat, 02 Aug 2008 08:44:09 +0200"
Date: Sat, 02 Aug 2008 12:12:50 -0400
Message-ID: <4111.1217693570@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>

Thomas Hallgren <thomas@tada.se> writes:
> Tom Lane wrote:
>> The problem that we've seen in the past shows up when the user lies in
>> the CREATE TYPE command, specifying type representation properties that
>> are different from what the underlying functions expect.

> This is a non-issue in PL/Java. An integer parameter is never passed by 
> reference and there's no way the PL/Java user can get direct access to 
> backend memory.

So what exactly does happen when the user deliberately specifies wrong
typlen/typbyval/typalign info when creating a type based on PL/Java
functions?

> I think that assumption is without ground. Java doesn't permit you to 
> access memory unless you use Java classes (java.nio stuff) that is 
> explicitly designed to do that and you need native code to set such 
> things up. A PL/Java user can not do that unless he is able to link in 
> other shared objects or dll's to the backend process.

PL/Java itself must be doing "unsafe" things in order to interface with
PG at all.  So what your argument really is is that you have managed to
securely sandbox the user-written code you are calling.  That might or
might not be true, but I don't think that worrying about it is without
foundation.

			regards, tom lane