Re: Per-function search_path => per-function GUC settings

Peter Eisentraut <peter_e@gmx.net> writes:
> Well, a SECURITY DEFINER function either sets its own search path, in which 
> case a default search path would have no effect, or it doesn't set its own 
> search path, in which case it's already broken (albeit in a different way).  
> So setting a default search path can only be a net gain.

It would break functions that actually want to use a caller-specified
search path, and protect themselves by explicitly schema-qualifying
every other reference than one to some caller-specified object.  Which
admittedly is notationally a pain in the neck, but it's possible to do.
I do not think that we should foreclose potentially useful behavior
*and* make a major break in backward compatibility in order to make
a very small improvement in security.
        regards, tom lane