Horton

Re: [HACKERS] Possible make_oidjoins_check Security Issue

Neil Conway <neilc@samurai.com>

View thread
From: Neil Conway <neilc@samurai.com>
To: Bruce Momjian <pgman@candle.pha.pa.us>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Rod Taylor <pg@rbt.ca>, PostgreSQL-patches <pgsql-patches@postgresql.org>
Date: 2004-11-03T23:21:04Z
Lists: pgsql-hackers 
On Thu, 2004-11-04 at 10:07, Bruce Momjian wrote:
> My method is secure, and I think we do have to handle this in a way that
> addresses the security concerns.

I think Tom's fix adequately addresses the security concerns. Exactly
what is wrong with writing to the current working directory?

> It is easy to say no one would run
> this under normal use but that isn't really a safe answer for the
> security folks, I think.

This is a non-sequitor -- I don't think Tom or anyone else has argued
this.

-Neil