From 540b4e5bc85f7e44842493a810b04a84881db20f Mon Sep 17 00:00:00 2001 From: Noah Misch Date: Mon, 17 Feb 2014 09:33:31 -0500 Subject: [PATCH] Document security implications of check_function_bodies. Back-patch to 8.4 (all supported versions). --- doc/src/sgml/config.sgml | 8 +++++--- doc/src/sgml/plhandler.sgml | 12 +++++++----- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index e12778b263..4dc1277f25 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -5153,9 +5153,11 @@ COPY postgres_log FROM '/full/path/to/logfile.csv' WITH csv; This parameter is normally on. When set to off, it disables validation of the function body string during . Disabling validation is - occasionally useful to avoid problems such as forward references - when restoring function definitions from a dump. + linkend="sql-createfunction">. Disabling validation avoids side + effects of the validation process and avoids false positives due + to problems such as forward references. Set this parameter + to off before loading functions on behalf of other + users; pg_dump does so automatically. diff --git a/doc/src/sgml/plhandler.sgml b/doc/src/sgml/plhandler.sgml index aa4bba3bee..0fc5d7b411 100644 --- a/doc/src/sgml/plhandler.sgml +++ b/doc/src/sgml/plhandler.sgml @@ -194,11 +194,13 @@ CREATE LANGUAGE plsample Validator functions should typically honor the parameter: if it is turned off then - any expensive or context-sensitive checking should be skipped. - In particular, this parameter is turned off by pg_dump - so that it can load procedural language functions without worrying - about possible dependencies of the function bodies on other database - objects. (Because of this requirement, the call handler should avoid + any expensive or context-sensitive checking should be skipped. If the + language provides for code execution at compilation time, the validator + must suppress checks that would induce such execution. In particular, + this parameter is turned off by pg_dump so that it can + load procedural language functions without worrying about side effects or + dependencies of the function bodies on other database objects. + (Because of this requirement, the call handler should avoid assuming that the validator has fully checked the function. The point of having a validator is not to let the call handler omit checks, but to notify the user immediately if there are obvious errors in a