Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It only takes a minute to sign up.
Sign up to join this community
According to the docs:
PL/Python is only available as an "untrusted" language, meaning it does not offer any way of restricting what users can do in it and is therefore named plpythonu. A trusted variant plpython might become available in the future if a secure execution mechanism is developed in Python.
Why exactly is it difficult to develop a secure execution mechanism for Python but not for other languages such as Perl?
It's to do with Python's object model - there's always a way to get a reference to objects that could be unsafe. See the rexec module documentation and the restricted execution chapter of the docs for some info on the problems, as well as:
The limitations aren't anything to do with PostgreSQL its self, they're inherent to the CPython interpreter implementation or possibly even the Python language its self.
Some other languages have checked runtimes, like Perl, Java, JavaScript and Lua. Most of them have faced a series of security issues as such confined execution environments are very hard to protect against all possible jailbreak exploits.
There's really nothing stopping PostgreSQL from adding a semitrusted Python interpreter, since rexec is "good enough" for many purposes. PostgreSQL doesn't tend to be keen on only-mostly-kinda-good-enough-maybe though. It would probably only be accepted if marked superuser-only, but you could always then grant access to it for specific users. It'd be better than untrusted Python.
Personally I think PL/V8 or similar is the future here, and would like to see it move toward being supported in core.
I've also vaguely explored the idea of a trusted Mono that can load "safe" assemblies written in C#, VB.NET, IronPython, or whatever but haven't been able to do much on that topic.
rexec module as inherently insecure, as linked above. I imagine maybe a plpython using PyPi might be able to deliver a restricted mode that Pg could then use. I haven't looked to see if there's much work. You are incorrect about a "special trusted version of Perl" too - it is in fact perfectly ordinary Perl, the same interpreter is used for plperl and plperlu. The difference is the runtime configuration.
Sep 11, 2019 at 5:30
pp_require_safe and plperl_trusted_init. I don't know enough to have much of an opinion as to the true safety of restricted Perl execution. I would prefer to see a trusted version of Lua or to get better mindshare and adoption, a trusted JavaScript interpreter. But what we have is plperl for now.
Sep 11, 2019 at 5:37