Is the `pganalyze.get_column_stats()` function unsafe ? about collector

[lfittl]

@JordanP Thanks for reaching out on this!

Whilst it's generally a best practice to add the search_path to SECURITY DEFINER functions, in practice this shouldn't make a difference with these functions, because the referenced objects are fully qualified. We'll still review whether we can adjust the function definitions here, to include the search_path, since its a good best practice to have any way.

But to be fully clear, it's our assessment that the SECURITY DEFINER functions are safe and do not require any changes.

In case you have any details on how the current functions would be exploitable, please send us details to [email protected] - thanks!