Tom Lane wrote:
>
> "Sander Steffann" <sander@steffann.nl> writes:
> > But he is right in that his trick works. This proves that views can not be
> > safely used for security, which is an important thing to realise...
>
> A different way to look at it is that the privilege of creating
> functions shouldn't be handed out willy-nilly. The trick of hiding
> recording operations in a function can be used in other ways besides
> this one.
Tom,
If a user has permissions to write PL/SQL functions, and the statistics
collector is running with STATS_COMMAND_STRING = true, could not that
user "log" other users' queries using the same technique I described by
querying pg_stat_activity? If so, isn't the labeling of PL/SQL (or
PL/Tcl, PL/Perl, etc.) as 'TRUSTED' an overstatement? ;-)
Mike Mascari
mascarm@mascari.com