Re: [ANNOUNCE] Advisory on possibly insecure security definer functions

Поиск
Список
Период
Сортировка
От Kenneth Downs
Тема Re: [ANNOUNCE] Advisory on possibly insecure security definer functions
Дата
Msg-id 45D389B6.4050505@secdat.com
обсуждение исходный текст
Ответ на [ANNOUNCE] Advisory on possibly insecure security definer functions  ("Peter Eisentraut" <peter_e@gmx.net>)
Список pgsql-general
Peter Eisentraut wrote:
> The proper fix for this problem is to insert explicit SET search_path
> commands into each affected function to produce a known safe schema
> search path.  Note that using the default search path, which includes a
> reference to the "$user" schema, is not safe when unqualified
> references are intended to be found in the "public" schema and "$user"
> schemas exist or can be created by other users.  It is also not
> recommended to rely on rigorously schema-qualifying all function and
> operator invocations in function source texts, as such measures are
> likely to induce mistakes and will furthermore make the source code
> harder to read and maintain.
>
>


I do enjoy code generators.  This was a one-line fix for me.


Вложения

В списке pgsql-general по дате отправления:

Предыдущее
От: "Mikko Partio"
Дата:
Сообщение: Re: Cast record as text
Следующее
От: "John D. Burger"
Дата:
Сообщение: Re: Recover anything from dropped database?