| From: | Martijn van Oosterhout <kleptog(at)svana(dot)org> |
|---|---|
| To: | Robert Haas <robertmhaas(at)gmail(dot)com> |
| Cc: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Alvaro Herrera <alvherre(at)alvh(dot)no-ip(dot)org>, pgsql-hackers <pgsql-hackers(at)postgresql(dot)org> |
| Subject: | Re: temporary functions (and other object types) |
| Date: | 2010-11-06 11:04:29 |
| Message-ID: | 20101106110429.GA16610@svana.org |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On Fri, Nov 05, 2010 at 09:01:50PM -0400, Robert Haas wrote:
> On Fri, Nov 5, 2010 at 4:02 PM, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
> > The latter is an intentional security feature and will not get changed.
>
> I see that there could be a problem here with SECURITY DEFINER
> functions, but I'm not clear whether it goes beyond that?
IIRC correctly it's because even unpriveledged users can make things in
the pg_temp schema and it's implicitly at the front of the search_path.
There was a CVE about this a while back, no?
Have a nice day,
--
Martijn van Oosterhout <kleptog(at)svana(dot)org> http://svana.org/kleptog/
> Patriotism is when love of your own people comes first; nationalism,
> when hate for people other than your own comes first.
> - Charles de Gaulle
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Peter Eisentraut | 2010-11-06 11:35:30 | Re: improved parallel make support |
| Previous Message | Gurjeet Singh | 2010-11-06 10:42:40 | Protecting against unexpected zero-pages: proposal |