From: | KuroiNeko <evpopkov(at)carrier(dot)kiev(dot)ua> |
---|---|
To: | pgsql-hackers(at)postgreSQL(dot)org |
Subject: | Re: Security hole in PL/pgSQL |
Date: | 2001-01-29 16:01:02 |
Message-ID: | 3A7593BE.nail1NF1IN0JY@ed.ed |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
> the new EXECUTE command in PL/pgSQL is a security hole.
This actually depends but I must admit that I'm concerned too. However,
the responsibility for the results should be split adequately IMHO. DBAs
should take care about unathorized access to PGSQL server, that's why
pg_hba.conf is there. Programmers allowed in must make sure that only
relative paths or trusted directories are accessed (stripping out `../' and
prepending a pre-defined path is a must) Also, implementation of EXECUTE
should probably rely upon execle() with environment dropped to known secure
minimum.
Sorry if this all is already taken into consideration. Just want to second
Jan's statement.
--
From | Date | Subject | |
---|---|---|---|
Next Message | robert gravsjo | 2001-01-29 16:19:21 | Re: BLOB HOWTO?? |
Previous Message | Tom Lane | 2001-01-29 15:57:01 | Re: Security hole in PL/pgSQL |