Peter Eisentraut <peter_e@gmx.net> writes:
> Well, a SECURITY DEFINER function either sets its own search path, in which
> case a default search path would have no effect, or it doesn't set its own
> search path, in which case it's already broken (albeit in a different way).
> So setting a default search path can only be a net gain.
It would break functions that actually want to use a caller-specified
search path, and protect themselves by explicitly schema-qualifying
every other reference than one to some caller-specified object. Which
admittedly is notationally a pain in the neck, but it's possible to do.
I do not think that we should foreclose potentially useful behavior
*and* make a major break in backward compatibility in order to make
a very small improvement in security.
regards, tom lane