Potential vuln in example for "F.25.1.1. digest()"

Поиск
Список
Период
Сортировка
От PG Doc comments form
Тема Potential vuln in example for "F.25.1.1. digest()"
Дата
Msg-id 162921671324.1653.2466671901617491685@wrigleys.postgresql.org
обсуждение исходный текст
Ответы Re: Potential vuln in example for "F.25.1.1. digest()"  ("David G. Johnston" <david.g.johnston@gmail.com>)
Список pgsql-docs
The following documentation comment has been logged on the website:

Page: https://www.postgresql.org/docs/13/pgcrypto.html
Description:

Hi,
in "F.25.1.1. digest()" you suggest:

CREATE OR REPLACE FUNCTION sha1(bytea) returns text AS $$
    SELECT encode(digest($1, 'sha1'), 'hex')
$$ LANGUAGE SQL STRICT IMMUTABLE;

While this is a great example, it may expose a database app to
vulnerabilities if the attacker succeeds in overriding the function
sha1(...) in the app's user context (schema). This may or may not require
administrative privileges.
Explicitly putting it into the "postgres" schema and calling it using
"postgres.sha1(...)" could mitigate the risk in such a way that
administrative privileges are required.

Do you have an even better solution to secure it?

:-) Beat

В списке pgsql-docs по дате отправления:

Предыдущее
От: "David G. Johnston"
Дата:
Сообщение: Re: incorrect information in documentation
Следующее
От: "David G. Johnston"
Дата:
Сообщение: Re: Potential vuln in example for "F.25.1.1. digest()"