Re: [ANNOUNCE] Advisory on possibly insecure security definer functions

From: Kenneth Downs <ken(at)secdat(dot)com>
To: pgsql-general(at)postgresql(dot)org
Subject: Re: [ANNOUNCE] Advisory on possibly insecure security definer functions
Date: 2007-02-14 22:14:14
Message-ID: 45D389B6.4050505@secdat.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

Peter Eisentraut wrote:
> The proper fix for this problem is to insert explicit SET search_path
> commands into each affected function to produce a known safe schema
> search path. Note that using the default search path, which includes a
> reference to the "$user" schema, is not safe when unqualified
> references are intended to be found in the "public" schema and "$user"
> schemas exist or can be created by other users. It is also not
> recommended to rely on rigorously schema-qualifying all function and
> operator invocations in function source texts, as such measures are
> likely to induce mistakes and will furthermore make the source code
> harder to read and maintain.
>
>

I do enjoy code generators. This was a one-line fix for me.

Attachment Content-Type Size
ken.vcf text/x-vcard 261 bytes

In response to

Browse pgsql-general by date

  From Date Subject
Next Message John D. Burger 2007-02-14 22:14:56 Re: Recover anything from dropped database?
Previous Message Vladimir Zelinski 2007-02-14 21:35:32 Stored Procedure examples