From 5eecc1cafdbddb21def03e4dd52eb8acf66b6efd Mon Sep 17 00:00:00 2001 From: Noah Misch Date: Sat, 28 Jul 2018 20:08:01 -0700 Subject: Document security implications of qualified names. Commit 5770172cb0c9df9e6ce27c507b449557e5b45124 documented secure schema usage, and that advice suffices for using unqualified names securely. Document, in typeconv-func primarily, the additional issues that arise with qualified names. Back-patch to 9.3 (all supported versions). Reviewed by Jonathan S. Katz. Discussion: https://postgr.es/m/20180721012446.GA1840594@rfd.leadboat.com --- doc/src/sgml/ref/create_function.sgml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) (limited to 'doc/src/sgml/ref/create_function.sgml') diff --git a/doc/src/sgml/ref/create_function.sgml b/doc/src/sgml/ref/create_function.sgml index 8108a430951..4122b649cde 100644 --- a/doc/src/sgml/ref/create_function.sgml +++ b/doc/src/sgml/ref/create_function.sgml @@ -545,8 +545,11 @@ CREATE [ OR REPLACE ] FUNCTION file containing the dynamically loadable object, and link_symbol is the function's link symbol, that is, the name of the function in the C - language source code. If the link symbol is omitted, it is assumed - to be the same as the name of the SQL function being defined. + language source code. If the link symbol is omitted, it is assumed to + be the same as the name of the SQL function being defined. The C names + of all functions must be different, so you must give overloaded C + functions different C names (for example, use the argument types as + part of the C names). @@ -610,10 +613,9 @@ CREATE [ OR REPLACE ] FUNCTION PostgreSQL allows function overloading; that is, the same name can be used for several different functions so long as they have distinct - input argument types. However, the C names of all functions must be - different, so you must give overloaded C functions different C - names (for example, use the argument types as part of the C - names). + input argument types. Whether or not you use it, this capability entails + security precautions when calling functions in databases where some users + mistrust other users; see . -- cgit v1.2.3