Skip to content

Add explicit pg_temp to search_path #646

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
svenklemm merged 1 commit into from
Mar 14, 2026
Merged

Add explicit pg_temp to search_path #646

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions build_scripts/shared_install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -271,12 +271,12 @@ DECLARE
alter_sql text;
BEGIN

SET local search_path to 'pg_catalog';
SET local search_path to pg_catalog, pg_temp;

FOR alter_sql IN
SELECT
format(
$$ALTER FUNCTION %I.%I(%s) SET search_path = 'pg_catalog'$$,
$$ALTER FUNCTION %I.%I(%s) SET search_path = pg_catalog, pg_temp$$,
nspname,
proname,
pg_catalog.pg_get_function_identity_arguments(pp.oid)
Expand Down
16 changes: 8 additions & 8 deletions scripts/tsdbadmin.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ CREATE OR REPLACE FUNCTION tsdbadmin.assert_admin(
)
RETURNS void
LANGUAGE plpgsql
SET search_path TO 'pg_catalog'
SET search_path TO pg_catalog, pg_temp
AS $function$
DECLARE
-- We need to ensure we get the correct role. As we may be called from Security Definer functions, we should
Expand Down Expand Up @@ -139,7 +139,7 @@ CREATE OR REPLACE FUNCTION tsdbadmin.assert_password_requirements(
)
RETURNS void
LANGUAGE plpgsql
SET search_path TO 'pg_catalog'
SET search_path TO pg_catalog, pg_temp
SET log_statement TO 'none' -- We do not want any function handling passwords to be logged
AS $function$
DECLARE
Expand Down Expand Up @@ -174,7 +174,7 @@ CREATE OR REPLACE FUNCTION tsdbadmin.reset_password(
RETURNS record
LANGUAGE plpgsql
SECURITY DEFINER
SET search_path TO 'pg_catalog'
SET search_path TO pg_catalog, pg_temp
SET log_statement TO 'none' -- We do not want any function handling passwords to be logged
SET log_min_duration_statement TO '-1'
SET pg_stat_statements.track_utility TO 'off'
Expand Down Expand Up @@ -225,7 +225,7 @@ $$
DECLARE
pgcrypto_namespace oid := (SELECT extnamespace FROM pg_extension WHERE extname='pgcrypto');
BEGIN
EXECUTE format('ALTER FUNCTION tsdbadmin.reset_password SET search_path TO pg_catalog, %s;', pgcrypto_namespace::regnamespace);
EXECUTE format('ALTER FUNCTION tsdbadmin.reset_password SET search_path TO pg_catalog, %s, pg_temp;', pgcrypto_namespace::regnamespace);

/* We ensure the dependency we created on pgcrypto.gen_random_bytes is part of the catalogs

Expand All @@ -239,7 +239,7 @@ BEGIN
'tsdbadmin.reset_password'::regproc,
0,
'pg_catalog.pg_proc'::regclass,
format('%s.gen_random_bytes', pgcrypto_namespace::regnamespace)::regproc,
pg_catalog.format('%s.gen_random_bytes', pgcrypto_namespace::regnamespace)::regproc,
0,
'n'
;
Expand All @@ -260,7 +260,7 @@ CREATE OR REPLACE FUNCTION tsdbadmin.alter_user(
RETURNS name
LANGUAGE plpgsql
SECURITY DEFINER
SET search_path TO 'pg_catalog'
SET search_path TO pg_catalog, pg_temp
SET log_statement TO 'none' -- We do not want any function handling passwords to be logged
AS $function$
DECLARE
Expand Down Expand Up @@ -328,7 +328,7 @@ CREATE OR REPLACE FUNCTION tsdbadmin.create_user(
RETURNS record
LANGUAGE plpgsql
SECURITY DEFINER
SET search_path TO 'pg_catalog'
SET search_path TO pg_catalog, pg_temp
SET log_statement TO 'none' -- We do not want any function handling passwords to be logged
AS $function$
DECLARE
Expand Down Expand Up @@ -379,7 +379,7 @@ CREATE OR REPLACE FUNCTION tsdbadmin.drop_user(
RETURNS name
LANGUAGE plpgsql
SECURITY DEFINER
SET search_path to 'pg_catalog'
SET search_path to pg_catalog, pg_temp
AS $function$
BEGIN
IF if_exists AND to_regrole(username) IS NULL
Expand Down
Loading