Re: Per-function search_path => per-function GUC settings

Peter Eisentraut <peter_e(at)gmx(dot)net> writes:
> Well, a SECURITY DEFINER function either sets its own search path, in which
> case a default search path would have no effect, or it doesn't set its own
> search path, in which case it's already broken (albeit in a different way).
> So setting a default search path can only be a net gain.

It would break functions that actually want to use a caller-specified
search path, and protect themselves by explicitly schema-qualifying
every other reference than one to some caller-specified object. Which
admittedly is notationally a pain in the neck, but it's possible to do.
I do not think that we should foreclose potentially useful behavior
*and* make a major break in backward compatibility in order to make
a very small improvement in security.

regards, tom lane