postgres=# select * from sessions where video_id = 'samLkrC5xQA';
Postgres Hacking 101: prevent unqualified DML
Prototype GUCs rejecting unqualified UPDATE and DELETE.
session summary
The group prototyped opt-in GUCs to reject UPDATE and DELETE plans that would affect an entire table. They added checks after planning, which also reject constant-true predicates optimized away but can be bypassed by volatile expressions, exposing ambiguity between syntactic WHERE protection and actual full-table impact. They implemented separate prevent_unqualified_deletes and prevent_unqualified_updates settings, tested role-level defaults and permissions, noted users could disable their own safeguards without stronger controls, and prepared a rough patch for pgsql-hackers discussion.
timecodes
- One-click CommitFest testing with PG Cloud Hacker
- Checking the transaction_timeout workspace
- Idea: reject destructive unqualified DML
- Finding command type and WHERE quals in Query
- First planner check for DELETE
- Constant predicates reveal semantic ambiguity
- Naming two opt-in safety GUCs
- Role settings, bypasses, and patch submission