Horton

Re: security_definer_search_path GUC

Marko Tiikkaja <marko@joh.to>

View thread
From: Marko Tiikkaja <marko@joh.to>
To: Alvaro Herrera <alvherre@alvh.no-ip.org>
Cc: Joel Jacobson <joel@compiler.org>, Pavel Stehule <pavel.stehule@gmail.com>, PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Date: 2021-06-02T22:50:17Z
Lists: pgsql-hackers

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

  1. Create a new GUC variable search_path to control the namespace search

On Wed, Jun 2, 2021 at 10:20 PM Alvaro Herrera <alvherre@alvh.no-ip.org>
wrote:

> On 2021-Jun-02, Marko Tiikkaja wrote:
>
> > The use case is: version upgrades.  I want to be able to have a
> search_path
> > of something like 'pg_catalog, compat, public'.  That way we can provide
> > compatibility versions of newer functions in the "compat" schema, which
> get
> > taken over by pg_catalog when running on a newer version.  That way all
> the
> > compatibility crap is clearly separated from the stuff that should be in
> > "public".
>
> Can't you achieve that with "ALTER DATABASE .. SET search_path"?
>

No, because I have a thousand SECURITY DEFINER functions which have to
override search_path or they'd be insecure.


.m