{"action":"created","issue":{"url":"https://api.github.com/repos/keithf4/pg_partman/issues/108","repository_url":"https://api.github.com/repos/keithf4/pg_partman","labels_url":"https://api.github.com/repos/keithf4/pg_partman/issues/108/labels{/name}","comments_url":"https://api.github.com/repos/keithf4/pg_partman/issues/108/comments","events_url":"https://api.github.com/repos/keithf4/pg_partman/issues/108/events","html_url":"https://github.com/keithf4/pg_partman/pull/108","id":151240825,"number":108,"title":"Fix security definer security issue","user":{"login":"alvar-freude","id":12778311,"avatar_url":"https://avatars.githubusercontent.com/u/12778311?v=3","gravatar_id":"","url":"https://api.github.com/users/alvar-freude","html_url":"https://github.com/alvar-freude","followers_url":"https://api.github.com/users/alvar-freude/followers","following_url":"https://api.github.com/users/alvar-freude/following{/other_user}","gists_url":"https://api.github.com/users/alvar-freude/gists{/gist_id}","starred_url":"https://api.github.com/users/alvar-freude/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alvar-freude/subscriptions","organizations_url":"https://api.github.com/users/alvar-freude/orgs","repos_url":"https://api.github.com/users/alvar-freude/repos","events_url":"https://api.github.com/users/alvar-freude/events{/privacy}","received_events_url":"https://api.github.com/users/alvar-freude/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/keithf4/pg_partman/labels/confirmed%20bug","name":"confirmed bug","color":"fc2929"},{"url":"https://api.github.com/repos/keithf4/pg_partman/labels/in%20development","name":"in development","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":15,"created_at":"2016-04-26T21:14:59Z","updated_at":"2016-05-10T16:26:36Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/keithf4/pg_partman/pulls/108","html_url":"https://github.com/keithf4/pg_partman/pull/108","diff_url":"https://github.com/keithf4/pg_partman/pull/108.diff","patch_url":"https://github.com/keithf4/pg_partman/pull/108.patch"},"body":"The following changes fixes a security issue with all functions using `SECURITY DEFINER` and adds a test for this case.\r\n\r\nWhile running my test suite for an other project, I recognized that all functions with `SECURITY DEFINER` are created in a way, an attacker can misuse it.\r\n\r\nFor details see [Writing SECURITY DEFINER Functions Safely](http://www.postgresql.org/docs/current/static/sql-createfunction.html#SQL-CREATEFUNCTION-SECURITY) in the PostgreSQL documentation.\r\n\r\nThis pull request contains all changes and a test in `test/test-security--security-definer.sql` for this.\r\n\r\nThe fix is, that all `SECURITY DEFINER` functions need an explicit secure search path with pg_temp at the end. I added this in all functions.\r\n\r\nBeside this, I include a very simple init&start script to start a test instance from scratch and a fix for `.gitignore`, which now includes the compiled SQL.\r\n\r\n\r\nAll tests are OK (tested with PostgreSQL 9.5), beside some tests which fail in the same way without my changes:\r\n\r\n```\r\ntest/test-id-id-id-subpart.sql            (Wstat: 768 Tests: 1508 Failed: 0)\r\n  Non-zero exit status: 3\r\n  Parse errors: Bad plan.  You planned 3096 tests but ran 1508.\r\ntest/test-time-weekly-daily-subpart.sql   (Wstat: 0 Tests: 278 Failed: 4)\r\n  Failed tests:  169-171, 173\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/keithf4/pg_partman/issues/comments/218213036","html_url":"https://github.com/keithf4/pg_partman/pull/108#issuecomment-218213036","issue_url":"https://api.github.com/repos/keithf4/pg_partman/issues/108","id":218213036,"user":{"login":"keithf4","id":825402,"avatar_url":"https://avatars.githubusercontent.com/u/825402?v=3","gravatar_id":"","url":"https://api.github.com/users/keithf4","html_url":"https://github.com/keithf4","followers_url":"https://api.github.com/users/keithf4/followers","following_url":"https://api.github.com/users/keithf4/following{/other_user}","gists_url":"https://api.github.com/users/keithf4/gists{/gist_id}","starred_url":"https://api.github.com/users/keithf4/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/keithf4/subscriptions","organizations_url":"https://api.github.com/users/keithf4/orgs","repos_url":"https://api.github.com/users/keithf4/repos","events_url":"https://api.github.com/users/keithf4/events{/privacy}","received_events_url":"https://api.github.com/users/keithf4/received_events","type":"User","site_admin":false},"created_at":"2016-05-10T16:26:36Z","updated_at":"2016-05-10T16:26:36Z","body":"Yeah unfortunately that's not going to work with pg_jobmon being able to be installed/uninstalled at any time. Also doing some more testing, all my `set_config()` calls above actually have to have the final parameter set to `false` otherwise it breaks other functions that may get called within the same transaction/session as pg_partman. \r\n\r\nSo, I think I have a working fix for this in place. Just have to get some other issues sorted out."}}