Repository navigation
Schema-qualify functions/types/etc in our SQL wherever possible - #418
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
Broad security-sensitive SQL changes need human confirmation of PostgreSQL runtime and backward-compatibility validation.
Review effort: Balanced
Findings: None
What changed in this PR
Hardens pg_durable’s internal SQL against caller-controlled search_path settings while preserving user-authored SQL and replay-sensitive output.
Changes:
- Schema-qualifies runtime SQL objects, operators, and casts.
- Adds hostile-search-path regression coverage.
- Documents qualification rules and compatibility exceptions.
| File | Description |
|---|---|
| tests/e2e/sql/89_schema_qualification.sql | Tests public APIs with shadowed SQL objects. |
| src/worker.rs | Qualifies worker SQL and adds regression coverage. |
| src/types.rs | Hardens catalog queries; documents replay-sensitive SQL spelling. |
| src/origin.rs | Qualifies installation identity casts. |
| src/node_status.rs | Qualifies status-details checks and casts. |
| src/monitoring.rs | Qualifies monitoring queries and pagination expressions. |
| src/explain.rs | Qualifies instance and graph lookups. |
| src/endpoints.rs | Qualifies endpoint catalog comparisons. |
| src/dsl.rs | Qualifies variable, submission, and lifecycle SQL. |
| src/client.rs | Qualifies the caller-database cast. |
| src/activities/update_node_status.rs | Qualifies node-status updates and metadata checks. |
| src/activities/update_instance_status.rs | Qualifies timestamps and terminal-state comparisons. |
| src/activities/load_function_graph.rs | Qualifies graph-loading and transaction-visibility SQL. |
| src/activities/execute_http.rs | Qualifies types in HTTP privilege-check signatures. |
| .github/copilot-instructions.md | Documents qualification and compatibility guidance. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
Author
|
I'm snarfing the test change from #416. |
Run committed counterfeit metadata regressions in unique private databases, preserve shared df.start availability, and verify cleanup preserves assertion failures. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Thom Chiovoloni (thomcc-work)
force-pushed
the
thomcc/schema-qualified
branch
2 times, most recently
from
October 6, 2026 19:56
22f0d14 to
fb2ed86
Compare
Gokhan Gulbiz (gokhangulbiz)
pushed a commit
that referenced
this pull request
Oct 7, 2026
Cover merged PR #418 and its binary, schema and replay compatibility considerations; refresh the planned release date. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This was referenced Oct 7, 2026
Open
Thom Chiovoloni (thomcc-work)
pushed a commit
that referenced
this pull request
Oct 7, 2026
…ening (#417) * Prepare v0.2.9 release documentation Curate release history and upgrade guidance while preserving deferred runtime shutdown and server-side quiescence limitations. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Include SQL name-resolution hardening in v0.2.9 release notes Cover merged PR #418 and its binary, schema and replay compatibility considerations; refresh the planned release date. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Gokhan Gulbiz <gokhangulbiz@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In #401 (comment) I mentioned I would make a PR that schema-qualified everything. This is being a little paranoid, but accidentally running a user-controlled function when we shouldn't would be a big problem for us, so this is good to do defensively.
This also updates our copilot instructions so that agents maintain this convention.