Horton

Re: pg_get_functiondef forgets about most GUC_LIST_INPUT GUCs

Michael Paquier <michael@paquier.xyz>

View thread View on postgr.es
From: Michael Paquier <michael@paquier.xyz>
To: Arthur Zakirov <a.zakirov@postgrespro.ru>
Cc: Kyotaro HORIGUCHI <horiguchi.kyotaro@lab.ntt.co.jp>, tgl@sss.pgh.pa.us, pavel.stehule@gmail.com, michael.paquier@gmail.com, pgsql-hackers@postgresql.org
Date: 2018-03-16T01:21:39Z
Lists: pgsql-hackers 
On Thu, Mar 15, 2018 at 01:33:51PM +0300, Arthur Zakirov wrote:
> I think your approach has a vulnerability too. I believe that a
> non GUC_LIST_INPUT extension GUC which was used to create a function may
> become GUC_LIST_INPUT variable. If I'm not mistaken nothing stops from
> that. In this case values in proconfigislist won't be valide anymore.

I don't understand what you mean here.  Are you referring to a custom
GUC which was initially declared as not being a list, but became a list
after a plugin upgrade with the same name?  Isn't the author to blame in
this case?
--
Michael

Commits

  1. Prevent extensions from creating custom GUCs that are GUC_LIST_QUOTE.

  2. Fix mishandling of quoted-list GUC values in pg_dump and ruleutils.c.