Commit540b4e5

committed

Document security implications of check_function_bodies.

Back-patch to 8.4 (all supported versions).

1 parent537cbd3 commit540b4e5Copy full SHA for 540b4e5

File tree

+12

-8

lines changed

+12

-8

lines changed

Lines changed: 5 additions & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -5153,9 +5153,11 @@ COPY postgres_log FROM '/full/path/to/logfile.csv' WITH csv;`
`5153`	`5153`	`<para>`
`5154`	`5154`	`This parameter is normally on. When set to <literal>off</>, it`
`5155`	`5155`	`disables validation of the function body string during <xref`
`5156`		`- linkend="sql-createfunction">. Disabling validation is`
`5157`		`- occasionally useful to avoid problems such as forward references`
`5158`		`- when restoring function definitions from a dump.`
	`5156`	`+ linkend="sql-createfunction">. Disabling validation avoids side`
	`5157`	`+ effects of the validation process and avoids false positives due`
	`5158`	`+ to problems such as forward references. Set this parameter`
	`5159`	`+ to <literal>off</> before loading functions on behalf of other`
	`5160`	`+ users; <application>pg_dump</> does so automatically.`
`5159`	`5161`	`</para>`
`5160`	`5162`	`</listitem>`
`5161`	`5163`	`</varlistentry>`

Lines changed: 7 additions & 5 deletions

Original file line number	Diff line number	Diff line change
`@@ -194,11 +194,13 @@ CREATE LANGUAGE plsample`
`194`	`194`	`<para>`
`195`	`195`	`Validator functions should typically honor the <xref`
`196`	`196`	`linkend="guc-check-function-bodies"> parameter: if it is turned off then`
`197`		`- any expensive or context-sensitive checking should be skipped.`
`198`		`- In particular, this parameter is turned off by <application>pg_dump</>`
`199`		`- so that it can load procedural language functions without worrying`
`200`		`- about possible dependencies of the function bodies on other database`
`201`		`- objects. (Because of this requirement, the call handler should avoid`
	`197`	`+ any expensive or context-sensitive checking should be skipped. If the`
	`198`	`+ language provides for code execution at compilation time, the validator`
	`199`	`+ must suppress checks that would induce such execution. In particular,`
	`200`	`+ this parameter is turned off by <application>pg_dump</> so that it can`
	`201`	`+ load procedural language functions without worrying about side effects or`
	`202`	`+ dependencies of the function bodies on other database objects.`
	`203`	`+ (Because of this requirement, the call handler should avoid`
`202`	`204`	`assuming that the validator has fully checked the function. The point`
`203`	`205`	`of having a validator is not to let the call handler omit checks, but`
`204`	`206`	`to notify the user immediately if there are obvious errors in a`

Comments

(0)