Re: Restrict ALTER FUNCTION CALLED ON NULL INPUT (was Re: Not quite a security hole: CREATE LANGUAGE for non-superusers)

From: Robert Haas <robertmhaas(at)gmail(dot)com>
To: Noah Misch <noah(at)leadboat(dot)com>
Cc: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, pgsql-hackers(at)postgresql(dot)org
Subject: Re: Restrict ALTER FUNCTION CALLED ON NULL INPUT (was Re: Not quite a security hole: CREATE LANGUAGE for non-superusers)
Date: 2012-06-12 18:50:44
Message-ID: CA+TgmobU=g370Rr8VnCC2bnx++uGmDftuhtEs7ETnyDTsLoZrw@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

On Tue, Jun 12, 2012 at 11:31 AM, Noah Misch <noah(at)leadboat(dot)com> wrote:
>> > Here's a patch implementing that restriction.  To clarify, I see no need to
>> > repeat *all* the CREATE-time checks; for example, there's no need to recheck
>> > permission to use the return type.  The language usage check is enough.
>>
>> This seems bizarre and largely unnecessary.  As you stated to begin
>> with, granting ownership of a function implies some degree of trust.
>
> Yes, but I would never expect that level of trust to include access to crash
> the server as a consequence of the function's reliance on STRICT.

+1. Crashes are bad.

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Tom Lane 2012-06-12 19:13:26 Re: Restrict ALTER FUNCTION CALLED ON NULL INPUT (was Re: Not quite a security hole: CREATE LANGUAGE for non-superusers)
Previous Message Robert Haas 2012-06-12 18:49:04 Re: [COMMITTERS] pgsql: Mark JSON error detail messages for translation.