diff options
| author | Bruce Momjian <bruce@momjian.us> | 2022-08-31 21:10:37 -0400 |
|---|---|---|
| committer | Bruce Momjian <bruce@momjian.us> | 2022-08-31 21:10:37 -0400 |
| commit | b566f320c81878af248da0dda8f30b8327719692 (patch) | |
| tree | 54224332ab05eb21058f1a6984d204ca46ff5489 /doc/src/sgml/ref/create_function.sgml | |
| parent | 4eab0181a0e1a72d4a3dd524210c3384bd6396e9 (diff) | |
| download | postgresql-b566f320c81878af248da0dda8f30b8327719692.tar.gz postgresql-b566f320c81878af248da0dda8f30b8327719692.zip | |
doc: warn of SECURITY DEFINER schemas for non-sql_body functions
Non-sql_body functions are evaluated at runtime.
Reported-by: Erki Eessaar
Discussion: https://postgr.es/m/AM9PR01MB8268BF5E74E119828251FD34FE409@AM9PR01MB8268.eurprd01.prod.exchangelabs.com
Backpatch-through: 10
Diffstat (limited to 'doc/src/sgml/ref/create_function.sgml')
| -rw-r--r-- | doc/src/sgml/ref/create_function.sgml | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/doc/src/sgml/ref/create_function.sgml b/doc/src/sgml/ref/create_function.sgml index 7e6d52c7dcf..35869bf6ba6 100644 --- a/doc/src/sgml/ref/create_function.sgml +++ b/doc/src/sgml/ref/create_function.sgml @@ -779,7 +779,10 @@ SELECT * FROM dup(42); <para> Because a <literal>SECURITY DEFINER</literal> function is executed with the privileges of the user that owns it, care is needed to - ensure that the function cannot be misused. For security, + ensure that the function cannot be misused. This is particularly + important for non-<replaceable>sql_body</replaceable> functions because + their function bodies are evaluated at run-time, not creation time. + For security, <xref linkend="guc-search-path"/> should be set to exclude any schemas writable by untrusted users. This prevents malicious users from creating objects (e.g., tables, functions, and |