Re: [HACKERS] Possible make_oidjoins_check Security Issue

From: Bruce Momjian <pgman(at)candle(dot)pha(dot)pa(dot)us>
To: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Cc: Neil Conway <neilc(at)samurai(dot)com>, Rod Taylor <pg(at)rbt(dot)ca>, PostgreSQL-patches <pgsql-patches(at)postgresql(dot)org>
Subject: Re: [HACKERS] Possible make_oidjoins_check Security Issue
Date: 2004-11-03 22:45:59
Message-ID: 200411032245.iA3Mjxg05276@candle.pha.pa.us
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-hackers pgsql-patches

Tom Lane wrote:
> Bruce Momjian <pgman(at)candle(dot)pha(dot)pa(dot)us> writes:
> > I believe the proper way to handle this is a new directory under /tmp.
>
> It's definitely not worth the trouble. I looked at what configure does
> to make /tmp subdirectories portably, and it is spectacularly ugly
> (not to mention long). If make_oidjoins_check were a user-facing tool
> that would be one thing, but it isn't ...

From a public relations perspective and a code reuse perspective I think
we should create temporary tables securely. The attached applied patch
fixes contrib/findoidjoins/make_oidjoins_check.

--
Bruce Momjian | http://candle.pha.pa.us
pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073

Attachment Content-Type Size
unknown_filename text/plain 1.2 KB

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Bruce Momjian 2004-11-03 22:53:22 Re: [HACKERS] Possible make_oidjoins_check Security Issue
Previous Message Joshua D. Drake 2004-11-03 22:36:34 Re: pg_autovacuum is nice ... but ...

Browse pgsql-patches by date

  From Date Subject
Next Message Bruce Momjian 2004-11-03 22:53:22 Re: [HACKERS] Possible make_oidjoins_check Security Issue
Previous Message Tom Lane 2004-11-03 21:31:23 Re: Edit query buffer