Hacker News new | ask | show | jobs
by pcnc 917 days ago
Unfortunately python for Postgres is only available as an untrusted language extension, which can provide avenues for things like privilege escalation[0]

We’ve decided to only bundle trusted language extensions so that there is a balance between flexibility when it comes to users writing their own procedures, all while maintaining security.

[0] https://www.postgresql.org/docs/current/plpython.html

1 comments

Oh, interesting. Is it related related to any inherent property of CPython? As there's also trusted Perl, Tcl, Lua etc: https://wiki.postgresql.org/wiki/PL_Matrix