chore: additional path qualification

ansible/files/postgresql_extension_custom_scripts/amcheck/after-create.sql

@@ -1,10 +1,10 @@
 -- Grant postgres EXECUTE on amcheck functions in pg_catalog.
 do $$
 declare
-  saved_search_path text := (select current_setting('search_path'));
-  r record;
+  saved_search_path pg_catalog.text := (select pg_catalog.current_setting('search_path'));
+  r pg_catalog.record;
 begin
-  perform set_config('search_path', '', true);
+  perform pg_catalog.set_config('search_path', 'pg_catalog, pg_temp', true);
 
   for r in
     select p.oid::regprocedure as sig
@@ -16,5 +16,5 @@ begin
     execute format('grant execute on routine %s to postgres', r.sig);
   end loop;
 
-  perform set_config('search_path', saved_search_path, true);
+  perform pg_catalog.set_config('search_path', saved_search_path, true);
 end $$;

ansible/files/postgresql_extension_custom_scripts/before-create.sql

@@ -8,33 +8,33 @@
 -- extension` statement.
 do $$
 declare
-  search_path text;
-  _extname text;
-  _extschema text;
-  _extversion text;
-  _extcascade bool;
-  _r record;
+  saved_search_path pg_catalog.text := (select pg_catalog.current_setting('search_path'));
+  _extname pg_catalog.text;
+  _extschema pg_catalog.text;
+  _extversion pg_catalog.text;
+  _extcascade pg_catalog.bool;
+  _r pg_catalog.record;
+  _sql pg_catalog.text;
 begin
-  search_path := current_setting('search_path');
-  perform set_config('search_path', 'pg_catalog, pg_temp', true);
+  perform pg_catalog.set_config('search_path', 'pg_catalog, pg_temp', true);
 
   _extname := @extname@;
   _extschema := @extschema@;
   _extversion := @extversion@;
   _extcascade := @extcascade@;
 
   if not _extcascade then
-    perform set_config('search_path', search_path, true);
+    perform pg_catalog.set_config('search_path', saved_search_path, true);
     return;
   end if;
 
   if not exists (select from pg_extension where extname = 'pg_tle') then
-    perform set_config('search_path', search_path, true);
+    perform pg_catalog.set_config('search_path', saved_search_path, true);
     return;
   end if;
 
   if not exists (select from pgtle.available_extensions() where name = _extname) then
-    perform set_config('search_path', search_path, true);
+    perform pg_catalog.set_config('search_path', saved_search_path, true);
     return;
   end if;
 
@@ -91,19 +91,22 @@ begin
     where name in (select name from pg_available_extensions)
     intersect
     select name
-    from regexp_split_to_table(current_setting('supautils.privileged_extensions', true), '\s*,\s*') as t(name)
+    from regexp_split_to_table(pg_catalog.current_setting('supautils.privileged_extensions', true), '\s*,\s*') as t(name)
   ) loop
-    -- Create the dependency with the caller's search_path. Otherwise, when no
-    -- schema is specified, the dependency would be created in pg_catalog, the
-    -- first schema in our locked down search_path.
-    perform set_config('search_path', search_path, true);
+    -- Build the statement while search_path is still locked down, so format()
+    -- cannot be resolved through the caller's search_path.
     if _extschema is null then
-      execute(format('create extension if not exists %I cascade', _r.name));
+      _sql := pg_catalog.format('create extension if not exists %I cascade', _r.name);
     else
-      execute(format('create extension if not exists %I schema %I cascade', _r.name, _extschema));
+      _sql := pg_catalog.format('create extension if not exists %I schema %I cascade', _r.name, _extschema);
     end if;
-    perform set_config('search_path', 'pg_catalog, pg_temp', true);
+    -- Create the dependency with the caller's search_path. Otherwise, when no
+    -- schema is specified, the dependency would be created in pg_catalog, the
+    -- first schema in our locked down search_path.
+    perform pg_catalog.set_config('search_path', saved_search_path, true);
+    execute _sql;
+    perform pg_catalog.set_config('search_path', 'pg_catalog, pg_temp', true);
   end loop;
 
-  perform set_config('search_path', search_path, true);
+  perform pg_catalog.set_config('search_path', saved_search_path, true);
 end $$;

ansible/files/postgresql_extension_custom_scripts/dblink/after-create.sql

@@ -1,10 +1,9 @@
 do $$
 declare
-  search_path text;
-  r record;
+  saved_search_path pg_catalog.text := (select pg_catalog.current_setting('search_path'));
+  r pg_catalog.record;
 begin
-  search_path := current_setting('search_path');
-  perform set_config('search_path', 'pg_catalog, pg_temp', true);
+  perform pg_catalog.set_config('search_path', 'pg_catalog, pg_temp', true);
 
   for r in (select oid, (aclexplode(proacl)).grantee from pg_proc where proname = 'dblink_connect_u') loop
    continue when r.grantee = 'supabase_admin'::regrole;
@@ -15,6 +14,5 @@ begin
    );
   end loop;
 
-  perform set_config('search_path', search_path, true);
-end
-$$;
+  perform pg_catalog.set_config('search_path', saved_search_path, true);
+end $$;

ansible/files/postgresql_extension_custom_scripts/pgmq/after-create.sql

@@ -1,13 +1,12 @@
 do $$
 declare
-  extoid oid;
-  extversion text;
-  search_path text;
-  r record;
-  cls pg_class%rowtype;
+  saved_search_path pg_catalog.text := (select pg_catalog.current_setting('search_path'));
+  extoid pg_catalog.oid;
+  extversion pg_catalog.text;
+  r pg_catalog.record;
+  cls pg_catalog.pg_class%rowtype;
 begin
-  search_path := current_setting('search_path');
-  perform set_config('search_path', 'pg_catalog, pg_temp', true);
+  perform pg_catalog.set_config('search_path', 'pg_catalog, pg_temp', true);
 
   select e.oid, e.extversion into extoid, extversion from pg_extension e where extname = 'pgmq';
 
@@ -143,7 +142,7 @@ BEGIN
 
     RETURN TRUE;
 END;
-$func$ LANGUAGE plpgsql;
+$func$ LANGUAGE plpgsql SET search_path = pg_catalog, pg_temp;
 
   alter extension pgmq add function pgmq.drop_queue(text);
 
@@ -153,7 +152,7 @@ RETURNS BOOLEAN AS $shim$
 BEGIN
     RETURN pgmq.drop_queue(queue_name);
 END;
-$shim$ LANGUAGE plpgsql;
+$shim$ LANGUAGE plpgsql SET search_path = pg_catalog, pg_temp;
 
   alter extension pgmq add function pgmq.drop_queue(text, boolean);
 
@@ -192,5 +191,5 @@ $shim$ LANGUAGE plpgsql;
     end if;
   end loop;
 
-  perform set_config('search_path', search_path, true);
+  perform pg_catalog.set_config('search_path', saved_search_path, true);
 end $$;

ansible/files/postgresql_extension_custom_scripts/pgsodium/after-create.sql

@@ -1,12 +1,12 @@
-grant execute on function pgsodium.crypto_aead_det_decrypt(bytea, bytea, uuid, bytea) to service_role;
-grant execute on function pgsodium.crypto_aead_det_encrypt(bytea, bytea, uuid, bytea) to service_role;
+grant execute on function pgsodium.crypto_aead_det_decrypt(pg_catalog.bytea, pg_catalog.bytea, pg_catalog.uuid, pg_catalog.bytea) to service_role;
+grant execute on function pgsodium.crypto_aead_det_encrypt(pg_catalog.bytea, pg_catalog.bytea, pg_catalog.uuid, pg_catalog.bytea) to service_role;
 grant execute on function pgsodium.crypto_aead_det_keygen to service_role;
 
-CREATE OR REPLACE FUNCTION pgsodium.mask_role(masked_role regrole, source_name text, view_name text)
-RETURNS void
+CREATE OR REPLACE FUNCTION pgsodium.mask_role(masked_role pg_catalog.regrole, source_name pg_catalog.text, view_name pg_catalog.text)
+RETURNS pg_catalog.void
 LANGUAGE plpgsql
 SECURITY DEFINER
-SET search_path TO ''
+SET search_path TO pg_catalog, pg_temp
 AS $function$
 BEGIN
   EXECUTE format(

ansible/files/postgresql_extension_custom_scripts/pgsodium/before-create.sql

@@ -1,9 +1,13 @@
 do $$
 declare
-  _extversion text := @extversion@;
-  _r record;
+  saved_search_path pg_catalog.text := (select pg_catalog.current_setting('search_path'));
+  _extversion pg_catalog.text := @extversion@;
 begin
-  if _extversion is not null and _extversion != '3.1.8' then
+  perform pg_catalog.set_config('search_path', 'pg_catalog, pg_temp', true);
+
+  if _extversion is not null and _extversion OPERATOR(pg_catalog.<>) '3.1.8' then
     raise exception 'only pgsodium 3.1.8 is supported';
   end if;
+
+  perform pg_catalog.set_config('search_path', saved_search_path, true);
 end $$;

ansible/files/postgresql_extension_custom_scripts/supabase_vault/after-create.sql

@@ -1,10 +1,9 @@
 do $$
 declare
-  extversion text;
-  search_path text;
+  saved_search_path pg_catalog.text := (select pg_catalog.current_setting('search_path'));
+  extversion pg_catalog.text;
 begin
-  search_path := current_setting('search_path');
-  perform set_config('search_path', 'pg_catalog, pg_temp', true);
+  perform pg_catalog.set_config('search_path', 'pg_catalog, pg_temp', true);
 
   select e.extversion into extversion from pg_extension e where e.extname = 'supabase_vault';
 
@@ -19,5 +18,5 @@ begin
     grant execute on function vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt to service_role;
   end if;
 
-  perform set_config('search_path', search_path, true);
+  perform pg_catalog.set_config('search_path', saved_search_path, true);
 end $$;

migrations/db/migrations/20261023000000_pgmq_drop_queue_search_path.sql

@@ -0,0 +1,19 @@
+-- migrate:up
+
+-- pgmq/after-create.sql replaces pgmq.drop_queue with an override (and a
+-- 2-arg compat shim) that previously resolved names through the caller's
+-- search_path. New installs now pin it; pin it on existing instances too.
+-- Every drop_queue body shipped by pgmq (1.4.4, 1.5.1) or by the override
+-- schema-qualifies its non-catalog references, so pinning is safe whichever
+-- one an instance currently has.
+do $$
+begin
+  if pg_catalog.to_regprocedure('pgmq.drop_queue(text)') is not null then
+    alter function pgmq.drop_queue(text) set search_path = pg_catalog, pg_temp;
+  end if;
+  if pg_catalog.to_regprocedure('pgmq.drop_queue(text, boolean)') is not null then
+    alter function pgmq.drop_queue(text, boolean) set search_path = pg_catalog, pg_temp;
+  end if;
+end $$;
+
+-- migrate:down

nix/tests/expected/pgmq.out

@@ -245,3 +245,15 @@ select pgmq.create('Foo');
 
 (1 row)
 
+-- drop_queue and its compat shim are created by pgmq/after-create.sql and must
+-- pin search_path, otherwise they resolve names through the caller's
+select p.oid::regprocedure::text as func, p.proconfig
+from pg_proc p
+where p.oid in ('pgmq.drop_queue(text)'::regprocedure, 'pgmq.drop_queue(text,boolean)'::regprocedure)
+order by p.pronargs;
+             func              |              proconfig              
+-------------------------------+-------------------------------------
+ pgmq.drop_queue(text)         | {"search_path=pg_catalog, pg_temp"}
+ pgmq.drop_queue(text,boolean) | {"search_path=pg_catalog, pg_temp"}
+(2 rows)
+

nix/tests/sql/pgmq.sql

@@ -133,3 +133,10 @@ where p.pronamespace = 'pgmq'::regnamespace and p.proowner != 'postgres'::regrol
 
 -- restore the 'Foo' queue dropped by the cascade above
 select pgmq.create('Foo');
+
+-- drop_queue and its compat shim are created by pgmq/after-create.sql and must
+-- pin search_path, otherwise they resolve names through the caller's
+select p.oid::regprocedure::text as func, p.proconfig
+from pg_proc p
+where p.oid in ('pgmq.drop_queue(text)'::regprocedure, 'pgmq.drop_queue(text,boolean)'::regprocedure)
+order by p.pronargs;