• REL9_1_ALPHA1
• 303696c
• Compare

  Choose a tag to compare

  Loading

tglsfdc tagged this 03 Sep 01:34

Since the code underlying pg_get_expr() is not secure against malformedinput, and can't practically be made so, we need to prevent miscreantsfrom feeding arbitrary data to it.  We can do this securely by declaringpg_get_expr() to take a new datatype "pg_node_tree" and declaring thesystem catalog columns that hold nodeToString output to be of that type.There is no way at SQL level to create a non-null value of type pg_node_tree.Since the backend-internal operations that fill those catalog columnsoperate below the SQL level, they are oblivious to the datatype relabelingand don't need any changes.