Commit30b1c40

committed

Document security implications of check_function_bodies.

Back-patch to 8.4 (all supported versions).

1 parentfc4a04a commit30b1c40Copy full SHA for 30b1c40

File tree

+12

-8

lines changed

+12

-8

lines changed

Lines changed: 5 additions & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -4991,9 +4991,11 @@ COPY postgres_log FROM '/full/path/to/logfile.csv' WITH csv;`
`4991`	`4991`	`<para>`
`4992`	`4992`	`This parameter is normally on. When set to <literal>off</>, it`
`4993`	`4993`	`disables validation of the function body string during <xref`
`4994`		`- linkend="sql-createfunction">. Disabling validation is`
`4995`		`- occasionally useful to avoid problems such as forward references`
`4996`		`- when restoring function definitions from a dump.`
	`4994`	`+ linkend="sql-createfunction">. Disabling validation avoids side`
	`4995`	`+ effects of the validation process and avoids false positives due`
	`4996`	`+ to problems such as forward references. Set this parameter`
	`4997`	`+ to <literal>off</> before loading functions on behalf of other`
	`4998`	`+ users; <application>pg_dump</> does so automatically.`
`4997`	`4999`	`</para>`
`4998`	`5000`	`</listitem>`
`4999`	`5001`	`</varlistentry>`

Lines changed: 7 additions & 5 deletions

Original file line number	Diff line number	Diff line change
`@@ -194,11 +194,13 @@ CREATE LANGUAGE plsample`
`194`	`194`	`<para>`
`195`	`195`	`Validator functions should typically honor the <xref`
`196`	`196`	`linkend="guc-check-function-bodies"> parameter: if it is turned off then`
`197`		`- any expensive or context-sensitive checking should be skipped.`
`198`		`- In particular, this parameter is turned off by <application>pg_dump</>`
`199`		`- so that it can load procedural language functions without worrying`
`200`		`- about possible dependencies of the function bodies on other database`
`201`		`- objects. (Because of this requirement, the call handler should avoid`
	`197`	`+ any expensive or context-sensitive checking should be skipped. If the`
	`198`	`+ language provides for code execution at compilation time, the validator`
	`199`	`+ must suppress checks that would induce such execution. In particular,`
	`200`	`+ this parameter is turned off by <application>pg_dump</> so that it can`
	`201`	`+ load procedural language functions without worrying about side effects or`
	`202`	`+ dependencies of the function bodies on other database objects.`
	`203`	`+ (Because of this requirement, the call handler should avoid`
`202`	`204`	`assuming that the validator has fully checked the function. The point`
`203`	`205`	`of having a validator is not to let the call handler omit checks, but`
`204`	`206`	`to notify the user immediately if there are obvious errors in a`

Comments

(0)