Re: Specification for Trusted PLs?

Robert Haas wrote:
> On Sat, May 22, 2010 at 4:53 PM, C?dric Villemain
>  wrote:
> > 2010/5/21 Jan Wieck :
> >> The original idea was that a trusted language does not allow an unprivileged
> >> user to gain access to any object or data, he does not have access to
> >> without that language.
> >>
> >> This does not include data transformation functionality, like string
> >> processing or the like. As long as the user had legitimate access to the
> >> input datum, then every derived form thereof is OK.
> >
> > I find the current doc enough, add this prose from Jan as a comment
> > might help people perhaps.
> 
> Yeah, Jan's description is very clear and to the point.

The attached, applied patch clarifies the meaning of "trusted language"
in the documentation using Jan's description.

-- 
  Bruce Momjian          http://momjian.us
  EnterpriseDB                             http://enterprisedb.com
Index: doc/src/sgml/xplang.sgml
===================================================================
RCS file: /cvsroot/pgsql/doc/src/sgml/xplang.sgml,v
retrieving revision 1.37
diff -c -c -r1.37 xplang.sgml
*** doc/src/sgml/xplang.sgml	3 Apr 2010 07:22:56 -0000	1.37
--- doc/src/sgml/xplang.sgml	30 May 2010 02:21:53 -0000
***************
*** 151,158 ****
      VALIDATOR validator_function_name ;
  
        The optional key word TRUSTED specifies that
!       ordinary database users that have no superuser privileges should
!       be allowed to use this language to create functions and trigger
        procedures. Since PL functions are executed inside the database
        server, the TRUSTED flag should only be given
        for languages that do not allow access to database server
--- 151,160 ----
      VALIDATOR validator_function_name ;
  
        The optional key word TRUSTED specifies that
!       the language does not grant access to data that the user would
!       not otherwise have.  Trusted languages are designed for ordinary
!       database users (those without superuser privilege) and allows them
!       to safely create of functions and trigger
        procedures. Since PL functions are executed inside the database
        server, the TRUSTED flag should only be given
        for languages that do not allow access to database server
Index: doc/src/sgml/ref/create_language.sgml
===================================================================
RCS file: /cvsroot/pgsql/doc/src/sgml/ref/create_language.sgml,v
retrieving revision 1.50
diff -c -c -r1.50 create_language.sgml
*** doc/src/sgml/ref/create_language.sgml	3 Apr 2010 07:22:58 -0000	1.50
--- doc/src/sgml/ref/create_language.sgml	30 May 2010 02:21:53 -0000
***************
*** 104,114 ****
  
       
        
!        TRUSTED specifies that
!        the language is safe, that is, it does not offer an
!        unprivileged user any functionality to bypass access
!        restrictions. If this key word is omitted when registering the
!        language, only users with the
         PostgreSQL superuser privilege can
         use this language to create new functions.
        
--- 104,113 ----
  
       
        
!        TRUSTED specifies that the language does
!        not grant access to data that the user would not otherwise
!        have.  If this key word is omitted
!        when registering the language, only users with the
         PostgreSQL superuser privilege can
         use this language to create new functions.