Tom wrote: 
> Peter Eisentraut <peter_e@gmx.net> writes:
> > That doesn't quite work, because then no ordinary user can define a cast
> > from some built-in type to his own type.  What I'm thinking about is to
> > implement the USAGE privilege on types, and then you need to have that to
> > be allowed to create casts.
> 
> Still seems too weak.

Yes.

>  What about requiring ownership of at least one
> of the types?

I was thinking that too, but, would it be possible to circumvent such 
a restriction with a "type in the middle" attack ? 
Create your own type and then
1. (auto)cast type1 to own type
2. (auto)cast own type to type2 ?

Andreas

Tue, 23 Jul 2002 09:39:21 +0200
"Zeugswetter Andreas SB SD" <ZeugswetterA@spardat.at>
Re: CREATE CAST code review 
Zeugswetter Andreas SB SD writes:

> >  What about requiring ownership of at least one
> > of the types?
>
> I was thinking that too, but, would it be possible to circumvent such
> a restriction with a "type in the middle" attack ?
> Create your own type and then
> 1. (auto)cast type1 to own type
> 2. (auto)cast own type to type2 ?

But that doesn't affect casts between type1 and type2.  PostgreSQL doesn't
do indirect casts.

-- 
Peter Eisentraut   peter_e@gmx.net


Sat, 27 Jul 2002 20:08:09 +0200 (CEST)
Peter Eisentraut <peter_e@gmx.net>
Re: CREATE CAST code review 