Skip to content

Commit a64058b

Browse files
committed
Replace unsafe OR REPLACE clause and issue a recommendation for installation in a non-public scheme.
For more information, see the documentation: 37.17.6.2. Security Considerations for Extension Scripts (https://www.postgresql.org/docs/current/extend-extensions.html#EXTEND-EXTENSIONS-SECURITY) 5.9.6. Usage Patterns (https://www.postgresql.org/docs/current/ddl-schemas.html#DDL-SCHEMAS-PATTERNS)
1 parent e8de147 commit a64058b

File tree

4 files changed

+89
-86
lines changed

4 files changed

+89
-86
lines changed

README.md

+4-1
Original file line numberDiff line numberDiff line change
@@ -95,11 +95,14 @@ shared_preload_libraries = 'pg_pathman'
9595
9696
It is essential to restart the PostgreSQL instance. After that, execute the following query in psql:
9797
```plpgsql
98-
CREATE EXTENSION pg_pathman;
98+
CREATE SCHEMA pathman;
99+
CREATE EXTENSION pg_pathman WITH SCHEMA pathman;
99100
```
100101

101102
Done! Now it's time to setup your partitioning schemes.
102103

104+
> **Security notice**: Do not install pg_pathman in public schemas! Specify the schema explicitly using the WITH SCHEMA clause. Installing an extension in a scheme that is accessible to malicious users can lead to a privilege escalation attack.
105+
103106
> **Windows-specific**: pg_pathman imports several symbols (e.g. None_Receiver, InvalidObjectAddress) from PostgreSQL, which is fine by itself, but requires that those symbols are marked as `PGDLLIMPORT`. Unfortunately, some of them are not exported from vanilla PostgreSQL, which means that you have to either use Postgres Pro Standard/Enterprise (which includes all necessary patches), or patch and build your own distribution of PostgreSQL.
104107
105108
## How to update

hash.sql

+6-6
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,15 @@
33
* hash.sql
44
* HASH partitioning functions
55
*
6-
* Copyright (c) 2015-2016, Postgres Professional
6+
* Copyright (c) 2015-2020, Postgres Professional
77
*
88
* ------------------------------------------------------------------------
99
*/
1010

1111
/*
1212
* Creates hash partitions for specified relation
1313
*/
14-
CREATE OR REPLACE FUNCTION @[email protected]_hash_partitions(
14+
CREATE FUNCTION @[email protected]_hash_partitions(
1515
parent_relid REGCLASS,
1616
expression TEXT,
1717
partitions_count INT4,
@@ -53,7 +53,7 @@ SET client_min_messages = WARNING;
5353
*
5454
* lock_parent - should we take an exclusive lock?
5555
*/
56-
CREATE OR REPLACE FUNCTION @[email protected]_hash_partition(
56+
CREATE FUNCTION @[email protected]_hash_partition(
5757
old_partition REGCLASS,
5858
new_partition REGCLASS,
5959
lock_parent BOOL DEFAULT TRUE)
@@ -146,7 +146,7 @@ $$ LANGUAGE plpgsql;
146146
/*
147147
* Just create HASH partitions, called by create_hash_partitions().
148148
*/
149-
CREATE OR REPLACE FUNCTION @[email protected]_hash_partitions_internal(
149+
CREATE FUNCTION @[email protected]_hash_partitions_internal(
150150
parent_relid REGCLASS,
151151
attribute TEXT,
152152
partitions_count INT4,
@@ -158,14 +158,14 @@ LANGUAGE C;
158158
/*
159159
* Calculates hash for integer value
160160
*/
161-
CREATE OR REPLACE FUNCTION @[email protected]_hash_part_idx(INT4, INT4)
161+
CREATE FUNCTION @[email protected]_hash_part_idx(INT4, INT4)
162162
RETURNS INTEGER AS 'pg_pathman', 'get_hash_part_idx'
163163
LANGUAGE C STRICT;
164164

165165
/*
166166
* Build hash condition for a CHECK CONSTRAINT
167167
*/
168-
CREATE OR REPLACE FUNCTION @[email protected]_hash_condition(
168+
CREATE FUNCTION @[email protected]_hash_condition(
169169
attribute_type REGTYPE,
170170
attribute TEXT,
171171
partitions_count INT4,

0 commit comments

Comments
 (0)