postgres/definer-search-path
Checks that every SECURITY DEFINER function sets its search_path.
Part of the postgres configuration, at the recommended level. It runs at the commit stage, once per scope. gspot runs this check itself.
A definer function runs with its owner’s rights, and a caller who controls the search path chooses the objects it touches.
What to do
Section titled “What to do”Give the function an empty search_path in its definition, and qualify every name inside it.
Example
Section titled “Example”A SECURITY DEFINER function without a safe search path reports a finding. Add SET search_path = '' to the definition, and schema-qualify the objects in its body.
Turn it off
Section titled “Turn it off”Turn it off for some files, with a reason:
gspot ignore postgres/definer-search-path --paths "<glob>" --reason "<why>"