Re: SQL-standard function bodies and creating SECURITY DEFINER routines securely

2022-10-09 Thread Noah Misch
On Fri, Oct 07, 2022 at 09:35:49AM -0400, Bruce Momjian wrote: > On Fri, Oct 7, 2022 at 08:05:36AM +, Erki Eessaar wrote: > > I confirmed, that setting search_path is indeed sometimes needed in case of > > SECURITY DEFINER routines that have SQL-standard bodies. See an example at > > the > >

Re: SQL-standard function bodies and creating SECURITY DEFINER routines securely

2022-10-07 Thread Erki Eessaar
and is not needed. Best regards Erki Eessaar From: Bruce Momjian Sent: Friday, October 7, 2022 4:35 PM To: Erki Eessaar Cc: pgsql-docs@lists.postgresql.org ; Noah Misch ; Peter Eisentraut Subject: Re: SQL-standard function bodies and creating SECURITY DEFINER

Re: SQL-standard function bodies and creating SECURITY DEFINER routines securely

2022-10-07 Thread Bruce Momjian
On Fri, Oct 7, 2022 at 01:50:14PM +, Erki Eessaar wrote: > Hello > > Another example where explicit search path is needed. > > CREATE TABLE public.B(b INTEGER); > CREATE TABLE pg_temp.B(b INTEGER); > > CREATE OR REPLACE FUNCTION f3 () RETURNS VOID > LANGUAGE sql SECURITY DEFINER > BEGIN

Re: SQL-standard function bodies and creating SECURITY DEFINER routines securely

2022-10-07 Thread Bruce Momjian
On Fri, Oct 7, 2022 at 08:05:36AM +, Erki Eessaar wrote: > Hello > > I confirmed, that setting search_path is indeed sometimes needed in case of > SECURITY DEFINER routines that have SQL-standard bodies. See an example at the > end of the letter. > > I suggest the following paragraph to the

Re: SQL-standard function bodies and creating SECURITY DEFINER routines securely

2022-10-07 Thread Erki Eessaar
Subject: Re: SQL-standard function bodies and creating SECURITY DEFINER routines securely On Tue, Aug 16, 2022 at 03:32:36PM -0400, Bruce Momjian wrote: > On Sat, Dec 25, 2021 at 02:36:27PM +, Erki Eessaar wrote: > > > > Hello > > > > PostgreSQL 14 added the feature: &q

Re: SQL-standard function bodies and creating SECURITY DEFINER routines securely

2022-09-28 Thread Bruce Momjian
On Tue, Aug 16, 2022 at 03:32:36PM -0400, Bruce Momjian wrote: > On Sat, Dec 25, 2021 at 02:36:27PM +, Erki Eessaar wrote: > > > > Hello > > > > PostgreSQL 14 added the feature: "Allow SQL-language functions and > > procedures > > to use SQL-standard function bodies." > > > > If I

Re: SQL-standard function bodies and creating SECURITY DEFINER routines securely

2022-09-28 Thread Bruce Momjian
On Sun, Sep 11, 2022 at 09:46:47PM -0700, Noah Misch wrote: > On Thu, Sep 08, 2022 at 01:20:31PM +0200, Peter Eisentraut wrote: > > On 01.09.22 03:11, Bruce Momjian wrote: > > >On Tue, Aug 16, 2022 at 03:38:13PM -0400, Bruce Momjian wrote: > > >>On Tue, Aug 16, 2022 at 03:34:22PM -0400, Tom Lane

Re: SQL-standard function bodies and creating SECURITY DEFINER routines securely

2022-09-11 Thread Noah Misch
On Thu, Sep 08, 2022 at 01:20:31PM +0200, Peter Eisentraut wrote: > On 01.09.22 03:11, Bruce Momjian wrote: > >On Tue, Aug 16, 2022 at 03:38:13PM -0400, Bruce Momjian wrote: > >>On Tue, Aug 16, 2022 at 03:34:22PM -0400, Tom Lane wrote: > >>>Bruce Momjian writes: > I have written the attached

Re: SQL-standard function bodies and creating SECURITY DEFINER routines securely

2022-09-08 Thread Peter Eisentraut
On 01.09.22 03:11, Bruce Momjian wrote: On Tue, Aug 16, 2022 at 03:38:13PM -0400, Bruce Momjian wrote: On Tue, Aug 16, 2022 at 03:34:22PM -0400, Tom Lane wrote: Bruce Momjian writes: I have written the attached patch to mention this issue about sql_body functions. Spell-check, please.

Re: SQL-standard function bodies and creating SECURITY DEFINER routines securely

2022-08-31 Thread Bruce Momjian
On Tue, Aug 16, 2022 at 03:38:13PM -0400, Bruce Momjian wrote: > On Tue, Aug 16, 2022 at 03:34:22PM -0400, Tom Lane wrote: > > Bruce Momjian writes: > > > I have written the attached patch to mention this issue about sql_body > > > functions. > > > > Spell-check, please. Seems OK otherwise. >

Re: SQL-standard function bodies and creating SECURITY DEFINER routines securely

2022-08-16 Thread Bruce Momjian
On Tue, Aug 16, 2022 at 03:34:22PM -0400, Tom Lane wrote: > Bruce Momjian writes: > > I have written the attached patch to mention this issue about sql_body > > functions. > > Spell-check, please. Seems OK otherwise. Just when I think I didn't add enough text to warrant a spell check. :-(

Re: SQL-standard function bodies and creating SECURITY DEFINER routines securely

2022-08-16 Thread Tom Lane
Bruce Momjian writes: > I have written the attached patch to mention this issue about sql_body > functions. Spell-check, please. Seems OK otherwise. regards, tom lane

Re: SQL-standard function bodies and creating SECURITY DEFINER routines securely

2022-08-16 Thread Bruce Momjian
On Sat, Dec 25, 2021 at 02:36:27PM +, Erki Eessaar wrote: > > Hello > > PostgreSQL 14 added the feature: "Allow SQL-language functions and procedures > to use SQL-standard function bodies." > > If I understand correctly, then in this case the system will track > dependencies between tables