From c38c3080cb43e78bd1d082ad1ec3ad2af89c2601 Mon Sep 17 00:00:00 2001 From: Noah Misch Date: Mon, 17 Feb 2014 09:33:31 -0500 Subject: [PATCH] Document security implications of check_function_bodies. Back-patch to 8.4 (all supported versions). --- doc/src/sgml/config.sgml | 8 +++++--- doc/src/sgml/plhandler.sgml | 12 +++++++----- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index f5b6868569..10f2b447cb 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -4876,9 +4876,11 @@ COPY postgres_log FROM '/full/path/to/logfile.csv' WITH csv; This parameter is normally on. When set to off, it disables validation of the function body string during . Disabling validation is - occasionally useful to avoid problems such as forward references - when restoring function definitions from a dump. + linkend="sql-createfunction">. Disabling validation avoids side + effects of the validation process and avoids false positives due + to problems such as forward references. Set this parameter + to off before loading functions on behalf of other + users; pg_dump does so automatically. diff --git a/doc/src/sgml/plhandler.sgml b/doc/src/sgml/plhandler.sgml index aa4bba3bee..0fc5d7b411 100644 --- a/doc/src/sgml/plhandler.sgml +++ b/doc/src/sgml/plhandler.sgml @@ -194,11 +194,13 @@ CREATE LANGUAGE plsample Validator functions should typically honor the parameter: if it is turned off then - any expensive or context-sensitive checking should be skipped. - In particular, this parameter is turned off by pg_dump - so that it can load procedural language functions without worrying - about possible dependencies of the function bodies on other database - objects. (Because of this requirement, the call handler should avoid + any expensive or context-sensitive checking should be skipped. If the + language provides for code execution at compilation time, the validator + must suppress checks that would induce such execution. In particular, + this parameter is turned off by pg_dump so that it can + load procedural language functions without worrying about side effects or + dependencies of the function bodies on other database objects. + (Because of this requirement, the call handler should avoid assuming that the validator has fully checked the function. The point of having a validator is not to let the call handler omit checks, but to notify the user immediately if there are obvious errors in a -- 2.40.0