Skip to content

Commit 9c4e3f2

Browse files
committed
Use "create" without "or replace" in extension sql scripts.
Fixes security issue spotted by Sven Klemm, thanks! https://www.postgresql.org/docs/current/extend-extensions.html#EXTEND-EXTENSIONS-SECURITY Cc: @svenklemm
1 parent 34d21af commit 9c4e3f2

File tree

9 files changed

+17
-10
lines changed

9 files changed

+17
-10
lines changed

debian/changelog

+7
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
postgresql-unit (7.5-1) UNRELEASED; urgency=medium
2+
3+
* Use "create" without "or replace" in extension sql scripts.
4+
Fixes security issue spotted by Sven Klemm, thanks!
5+
6+
-- Christoph Berg <[email protected]> Mon, 16 May 2022 15:40:32 +0200
7+
18
postgresql-unit (7.4-2) unstable; urgency=medium
29

310
* B-D on postgresql-server-dev-all only instead of postgresql-all since we

expected/units.out

+1-1
Original file line numberDiff line numberDiff line change
@@ -2720,7 +2720,7 @@ SELECT name, unit, unit::text::unit, definition FROM unit_units WHERE unit::text
27202720

27212721
-- prefix-unit combinations that are ambiguous
27222722
/*
2723-
CREATE OR REPLACE FUNCTION valid_unit(u text)
2723+
CREATE FUNCTION valid_unit(u text)
27242724
RETURNS boolean LANGUAGE plpgsql
27252725
AS $$
27262726
BEGIN

sql/units.sql

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ SELECT name, unit, unit::text::unit, definition FROM unit_units WHERE unit::text
1616

1717
-- prefix-unit combinations that are ambiguous
1818
/*
19-
CREATE OR REPLACE FUNCTION valid_unit(u text)
19+
CREATE FUNCTION valid_unit(u text)
2020
RETURNS boolean LANGUAGE plpgsql
2121
AS $$
2222
BEGIN

unit--1--2.sql

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
ALTER TYPE unit_accum_t
22
ADD ATTRIBUTE squares double precision;
33

4-
CREATE OR REPLACE FUNCTION unit_accum(a unit_accum_t, u unit)
4+
CREATE FUNCTION unit_accum(a unit_accum_t, u unit)
55
RETURNS unit_accum_t
66
AS $$SELECT (CASE WHEN a.s = '0'::unit THEN u ELSE a.s + u END, a.squares + value(u)^2, a.n + 1)::unit_accum_t$$
77
LANGUAGE SQL IMMUTABLE STRICT;

unit--1.sql

+2-2
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,12 @@ GNU General Public License for more details.
1616

1717
CREATE TYPE unit;
1818

19-
CREATE OR REPLACE FUNCTION unit_in(cstring)
19+
CREATE FUNCTION unit_in(cstring)
2020
RETURNS unit
2121
AS '$libdir/unit'
2222
LANGUAGE C IMMUTABLE STRICT;
2323

24-
CREATE OR REPLACE FUNCTION unit_out(unit)
24+
CREATE FUNCTION unit_out(unit)
2525
RETURNS cstring
2626
AS '$libdir/unit'
2727
LANGUAGE C IMMUTABLE STRICT;

unit--2.sql

+2-2
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,12 @@ GNU General Public License for more details.
1616

1717
CREATE TYPE unit;
1818

19-
CREATE OR REPLACE FUNCTION unit_in(cstring)
19+
CREATE FUNCTION unit_in(cstring)
2020
RETURNS unit
2121
AS '$libdir/unit'
2222
LANGUAGE C IMMUTABLE STRICT;
2323

24-
CREATE OR REPLACE FUNCTION unit_out(unit)
24+
CREATE FUNCTION unit_out(unit)
2525
RETURNS cstring
2626
AS '$libdir/unit'
2727
LANGUAGE C IMMUTABLE STRICT;

unit--5--6.sql.in

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
GRANT SELECT ON unit_prefixes, unit_units TO PUBLIC;
22

3-
CREATE OR REPLACE FUNCTION unit_load()
3+
CREATE FUNCTION unit_load()
44
RETURNS VOID
55
LANGUAGE plpgsql
66
AS $$BEGIN

unit--6.sql.in

+1-1
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ SELECT pg_catalog.pg_extension_config_dump('unit_units', 'WHERE dump');
5757

5858
GRANT SELECT ON unit_prefixes, unit_units TO PUBLIC;
5959

60-
CREATE OR REPLACE FUNCTION unit_load()
60+
CREATE FUNCTION unit_load()
6161
RETURNS VOID
6262
LANGUAGE plpgsql
6363
AS $$BEGIN

unit--7.sql.in

+1-1
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ SELECT pg_catalog.pg_extension_config_dump('unit_units', 'WHERE dump');
6969

7070
GRANT SELECT ON unit_prefixes, unit_units TO PUBLIC;
7171

72-
CREATE OR REPLACE FUNCTION unit_load()
72+
CREATE FUNCTION unit_load()
7373
RETURNS VOID
7474
LANGUAGE plpgsql
7575
AS $$BEGIN

0 commit comments

Comments
 (0)