pgsql: Doc: stop implying recommendation of insecure search_path value.

From: Noah Misch <noah(at)leadboat(dot)com>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Doc: stop implying recommendation of insecure search_path value.
Date: 2025-05-01 23:53:48
Message-ID: E1uAdiu-000XqU-1X@gemulon.postgresql.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Doc: stop implying recommendation of insecure search_path value.

SQL "SET search_path = 'pg_catalog, pg_temp'" is silently equivalent to
"SET search_path = pg_temp, pg_catalog, "pg_catalog, pg_temp"" instead
of the intended "SET search_path = pg_catalog, pg_temp". (The intent
was a two-element search path. With the single quotes, it instead
specifies one element with a comma and a space in the middle of the
element.) In addition to the SET statement, this affects SET clauses of
CREATE FUNCTION, ALTER ROLE, and ALTER DATABASE. It does not affect the
set_config() SQL function.

Though the documentation did not show an insecure command, remove single
quotes that could entice a reader to write an insecure command.
Back-patch to v13 (all supported versions).

Reported-by: Sven Klemm <sven(at)timescale(dot)com>
Author: Sven Klemm <sven(at)timescale(dot)com>
Backpatch-through: 13

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/c6a26e4ccd1bf090ab755df2f597103798284d3a

Modified Files
--------------
doc/src/sgml/extend.sgml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Fujii Masao 2025-05-02 00:02:43 Re: pgsql: Add function to log the memory contexts of specified backend pro
Previous Message Robins Tharakan 2025-05-01 21:58:59 Re: pgsql: doc: Warn that ts_headline() output is not HTML-safe.