Re: Loose ends after CVE-2020-14350 (extension installation hazards)

From: Chapman Flack <chap(at)anastigmatix(dot)net>
To: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, pgsql-hackers(at)lists(dot)postgresql(dot)org
Subject: Re: Loose ends after CVE-2020-14350 (extension installation hazards)
Date: 2020-08-14 19:07:51
Message-ID: 5F36E107.50907@anastigmatix.net
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

On 08/14/20 14:50, Tom Lane wrote:
> SAVEPOINT s1;
> SET LOCAL search_path = pg_catalog, pg_temp;
> ... protected code here ...
> RELEASE SAVEPOINT s1;
>
> but this does not work because SET LOCAL persists to the end of the
> outer transaction. Maybe we could invent a variant that only lasts
> for the current subtransaction.

This reminds me of the way the SQL standard overloads WITH to supply
lexically-scoped settings of things, as well as CTEs, mentioned a while
back. [1]

Would this provide additional incentive to implement that syntax,
generalized to support arbitrary GUCs and not just the handful of
specific settings the standard uses it for?

Regards,
-Chap

[1] https://www.postgresql.org/message-id/5AAEAE0F.20006%40anastigmatix.net

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Tom Lane 2020-08-14 19:38:12 Re: Loose ends after CVE-2020-14350 (extension installation hazards)
Previous Message Tom Lane 2020-08-14 18:50:32 Loose ends after CVE-2020-14350 (extension installation hazards)