database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-05 07:21:24 +03:00
Code Activity

Document security implications of qualified names.

Browse Source 
Commit 5770172cb0 documented secure schema
usage, and that advice suffices for using unqualified names securely.
Document, in typeconv-func primarily, the additional issues that arise
with qualified names.  Back-patch to 9.3 (all supported versions).

Reviewed by Jonathan S. Katz.

Discussion: https://postgr.es/m/20180721012446.GA1840594@rfd.leadboat.com
This commit is contained in:
Noah Misch
2018-07-28 20:08:01 -07:00
parent 6bf0bc842b
commit e09144e6ce
6 changed files with 147 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
doc/src/sgml/ref/create_function.sgml
View File

@ -545,8 +545,11 @@ CREATE [ OR REPLACE ] FUNCTION
as for the <xref linkend="sql-load"/> command. The string
<replaceable class="parameter">link_symbol</replaceable> is the
function's link symbol, that is, the name of the function in the C
language source code. If the link symbol is omitted, it is assumed
to be the same as the name of the SQL function being defined.
language source code. If the link symbol is omitted, it is assumed to
be the same as the name of the SQL function being defined. The C names
of all functions must be different, so you must give overloaded C
functions different C names (for example, use the argument types as
part of the C names).
</para>
<para>
@ -575,10 +578,9 @@ CREATE [ OR REPLACE ] FUNCTION
<productname>PostgreSQL</productname> allows function
<firstterm>overloading</firstterm>; that is, the same name can be
used for several different functions so long as they have distinct
input argument types. However, the C names of all functions must be
different, so you must give overloaded C functions different C
names (for example, use the argument types as part of the C
names).
input argument types. Whether or not you use it, this capability entails
security precautions when calling functions in databases where some users
mistrust other users; see <xref linkend="typeconv-func"/>.
</para>
<para>