database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-28 23:42:10 +03:00
Code Activity

Document security implications of qualified names.

Browse Source 
Commit 5770172cb0 documented secure schema
usage, and that advice suffices for using unqualified names securely.
Document, in typeconv-func primarily, the additional issues that arise
with qualified names.  Back-patch to 9.3 (all supported versions).

Reviewed by Jonathan S. Katz.

Discussion: https://postgr.es/m/20180721012446.GA1840594@rfd.leadboat.com
This commit is contained in:
Noah Misch
2018-07-28 20:08:01 -07:00
parent 6bf0bc842b
commit e09144e6ce
6 changed files with 147 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
doc/src/sgml/syntax.sgml
View File

@ -1518,6 +1518,12 @@ sqrt(2)
Other functions can be added by the user.
</para>
<para>
When issuing queries in a database where some users mistrust other users,
observe security precautions from <xref linkend="typeconv-func"/> when
writing function calls.
</para>
<para>
The arguments can optionally have names attached.
See <xref linkend="sql-syntax-calling-funcs"/> for details.
@ -2590,6 +2596,8 @@ SELECT CASE WHEN min(employees) > 0
its argument values in the same order as they are defined in the function
declaration. In named notation, the arguments are matched to the
function parameters by name and can be written in any order.
For each notation, also consider the effect of function argument types,
documented in <xref linkend="typeconv-func"/>.
</para>
<para>