From 8bd054a4c3108222b1d0996bc988ec393358e20c Mon Sep 17 00:00:00 2001 From: Bruce Momjian Date: Wed, 31 Aug 2022 21:10:37 -0400 Subject: [PATCH] doc: warn of SECURITY DEFINER schemas for non-sql_body functions Non-sql_body functions are evaluated at runtime. Reported-by: Erki Eessaar Discussion: https://postgr.es/m/AM9PR01MB8268BF5E74E119828251FD34FE409@AM9PR01MB8268.eurprd01.prod.exchangelabs.com Backpatch-through: 10 --- doc/src/sgml/ref/create_function.sgml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/doc/src/sgml/ref/create_function.sgml b/doc/src/sgml/ref/create_function.sgml index 01b7d18f9e..e71ca092c6 100644 --- a/doc/src/sgml/ref/create_function.sgml +++ b/doc/src/sgml/ref/create_function.sgml @@ -729,7 +729,10 @@ SELECT * FROM dup(42); Because a SECURITY DEFINER function is executed with the privileges of the user that owns it, care is needed to - ensure that the function cannot be misused. For security, + ensure that the function cannot be misused. This is particularly + important for non-sql_body functions because + their function bodies are evaluated at run-time, not creation time. + For security, should be set to exclude any schemas writable by untrusted users. This prevents malicious users from creating objects (e.g., tables, functions, and