From: | Robert Haas <robertmhaas(at)gmail(dot)com> |
---|---|
To: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
Cc: | Kris Jurka <books(at)ejurka(dot)com>, Heikki Linnakangas <heikki(dot)linnakangas(at)enterprisedb(dot)com>, Rushabh Lathia <rushabh(dot)lathia(at)gmail(dot)com>, PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org>, Rushabh Lathia <rushabh(dot)lathia(at)enterprisedb(dot)com> |
Subject: | Re: [BUGS] Server crash while trying to read expression using pg_get_expr() |
Date: | 2010-06-09 17:40:35 |
Message-ID: | AANLkTin1gQxJjQy0W0AAqrOHit-HHyq6jtyxCYxyXdAu@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-bugs pgsql-hackers |
On Wed, Jun 9, 2010 at 1:34 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
> Kris Jurka <books(at)ejurka(dot)com> writes:
>> On Wed, 9 Jun 2010, Heikki Linnakangas wrote:
>>> Are you thinking we should retrict pg_get_expr() to superusers then?
>
>> That seems like it will cause problems for both pg_dump and drivers which
>> want to return metadata as pg_get_expr has been the recommended way of
>> fetching this information.
>
> Yes, it's not a trivial fix either. We'll have to provide functions or
> views that replace the current usages without letting the user insert
> untrusted strings.
Maybe I'm all wet here, but don't we need to come up with something we
can back-patch?
--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise Postgres Company
From | Date | Subject | |
---|---|---|---|
Next Message | Tom Lane | 2010-06-09 18:04:44 | Re: [BUGS] Server crash while trying to read expression using pg_get_expr() |
Previous Message | Tom Lane | 2010-06-09 17:34:13 | Re: [BUGS] Server crash while trying to read expression using pg_get_expr() |
From | Date | Subject | |
---|---|---|---|
Next Message | David E. Wheeler | 2010-06-09 17:41:09 | Re: hstore ==> and deprecate => |
Previous Message | Tom Lane | 2010-06-09 17:34:13 | Re: [BUGS] Server crash while trying to read expression using pg_get_expr() |