database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-30 11:03:19 +03:00
Code Activity

Use @extschema:name@ notation in contrib transform modules.

Browse Source 
Harden hstore_plperl, hstore_plpython, and ltree_plpython
against search-path-based attacks by using @extschema:name@
notation to refer to the underlying hstore or ltree data type.

This allows removal of the previous documentation warning
suggesting that they must be installed in the same schema as
the underlying data type.  In passing, also improve a para in
extend.sgml to suggest using @extschema:name@ for such purposes.

Discussion: https://postgr.es/m/692480.1736021695@sss.pgh.pa.us
This commit is contained in:
Tom Lane
2025-01-09 15:16:56 -05:00
parent ebd8fc7e47
commit bebe904038
7 changed files with 13 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
contrib/hstore_plperl/hstore_plperl--1.0.sql
View File

@ -7,11 +7,11 @@ CREATE FUNCTION hstore_to_plperl(val internal) RETURNS internal
LANGUAGE C STRICT IMMUTABLE
AS 'MODULE_PATHNAME';
CREATE FUNCTION plperl_to_hstore(val internal) RETURNS hstore
CREATE FUNCTION plperl_to_hstore(val internal) RETURNS @extschema:hstore@.hstore
LANGUAGE C STRICT IMMUTABLE
AS 'MODULE_PATHNAME';
CREATE TRANSFORM FOR hstore LANGUAGE plperl (
CREATE TRANSFORM FOR @extschema:hstore@.hstore LANGUAGE plperl (
FROM SQL WITH FUNCTION hstore_to_plperl(internal),
TO SQL WITH FUNCTION plperl_to_hstore(internal)
);

4
contrib/hstore_plperl/hstore_plperlu--1.0.sql
View File

@ -7,11 +7,11 @@ CREATE FUNCTION hstore_to_plperlu(val internal) RETURNS internal
LANGUAGE C STRICT IMMUTABLE
AS 'MODULE_PATHNAME', 'hstore_to_plperl';
CREATE FUNCTION plperlu_to_hstore(val internal) RETURNS hstore
CREATE FUNCTION plperlu_to_hstore(val internal) RETURNS @extschema:hstore@.hstore
LANGUAGE C STRICT IMMUTABLE
AS 'MODULE_PATHNAME', 'plperl_to_hstore';
CREATE TRANSFORM FOR hstore LANGUAGE plperlu (
CREATE TRANSFORM FOR @extschema:hstore@.hstore LANGUAGE plperlu (
FROM SQL WITH FUNCTION hstore_to_plperlu(internal),
TO SQL WITH FUNCTION plperlu_to_hstore(internal)
);