On Mon, Oct 06, 2014 at 03:15:25PM -0400, Stephen Frost wrote: > > As far as I can see, the previous code only looked up any given name > > once. If you got a relation name, DoCopy() looked it up, and then > > BeginCopy() references it only by the passed-down Relation descriptor; > > if you got a query, DoCopy() ignores it, and then BeginCopy. All of > > which is fine, at least AFAICS; if you think otherwise, that should be > > reported to pgsql-security. > > Yeah, that's correct. I suppose there's some possible risk of things > changing between when you parse the query and when it actually gets > analyzed and rewritten, but that's not a security risk per-se..
I'm not sure I understand. If that change violates an access control, it's a security risk /per se/, as you put it. Are you saying that such changes, even though they might be bugs, categorically couldn't violate an access control? Cheers, David. -- David Fetter <da...@fetter.org> http://fetter.org/ Phone: +1 415 235 3778 AIM: dfetter666 Yahoo!: dfetter Skype: davidfetter XMPP: david.fet...@gmail.com iCal: webcal://www.tripit.com/feed/ical/people/david74/tripit.ics Remember to vote! Consider donating to Postgres: http://www.postgresql.org/about/donate -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers