8000 Document security implications of check_function_bodies. · postgrespro/postgres@540b4e5 · GitHub
[go: up one dir, main page]
Skip to content {"props":{"docsUrl":"https://docs.github.com/get-started/accessibility/keyboard-shortcuts"}}

Commit 540b4e5

Browse files
nmischnmischcommitted
Document security implications of check_function_bodies.
Back-patch to 8.4 (all supported versions).
1 parent 537cbd3 commit 540b4e5

File tree

2 files changed

+12
-8
lines changed

2 files changed

+12
-8
lines changed

‎doc/src/sgml/config.sgml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5153,9 +5153,11 @@ COPY postgres_log FROM '/full/path/to/logfile.csv' WITH csv;
51535153
<para>
51545154
This parameter is normally on. When set to <literal>off</>, it
51555155
disables validation of the function body string during <xref
5156-
linkend="sql-createfunction">. Disabling validation is
5157-
occasionally useful to avoid problems such as forward references
5158-
when restoring function definitions from a dump.
5156+
linkend="sql-createfunction">. Disabling validation avoids side
5157+
effects of the validation process and avoids false positives due
5158+
to problems such as forward references. Set this parameter
5159+
to <literal>off</> before loading functions on behalf of other
5160+
users; <application>pg_dump</> does so automatically.
51595161
</para>
51605162
</listitem>
51615163
</varlistentry>

‎doc/src/sgml/plhandler.sgml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -194,11 +194,13 @@ CREATE LANGUAGE plsample
194194
<para>
195195
Validator functions should typically honor the <xref
196196
linkend="guc-check-function-bodies"> parameter: if it is turned off then
197-
any expensive or context-sensitive checking should be skipped.
198-
In particular, this parameter is turned off by <application>pg_dump</>
199-
so that it can load procedural language functions without worrying
200-
about possible dependencies of the function bodies on other database
201-
objects. (Because of this requirement, the call handler should avoid
197+
any expensive or context-sensitive checking should be skipped. If the
198+
language provides for code execution at compilation time, the validator
199+
must suppress checks that would induce such execution. In particular,
200+
this parameter is turned off by <application>pg_dump</> so that it can
201+
load procedural language functions without worrying about side effects or
202+
dependencies of the function bodies on other database objects.
203+
(Because of this requirement, the call handler should avoid
202204
assuming that the validator has fully checked the function. The point
203205
of having a validator is not to let the call handler omit checks, but
204206
to notify the user immediately if there are obvious errors in a

0 commit comments

Comments
 (0)
0