Re: libxml2 author overwhelmed with security requests - Mailing list pgsql-hackers

From Tom Lane
Subject Re: libxml2 author overwhelmed with security requests
Date
Msg-id 1803697.1750367526@sss.pgh.pa.us
Whole thread Raw
In response to Re: libxml2 author overwhelmed with security requests  (Pavel Stehule <pavel.stehule@gmail.com>)
List pgsql-hackers
Pavel Stehule <pavel.stehule@gmail.com> writes:
> Own implementation of SQL/XML generating functions like XMLFOREST or
> XMLELEMENT should not be too
> difficult. Significantly more difficult problem is parsing of XML (more
> with namespaces), although some basic
> support for XMLTABLE should not be too hard too.

I don't think anybody really wants to roll our own XML parser.

> Isn't possible to call Rust code from C? Then maybe there are some
> possibility from Rust world
> https://github.com/ballsteve/xrust

Maybe.  I think the fundamental problem here, similar to what we've
run into elsewhere, is that we chose a library to depend on without
thinking hard enough about whether it would be well-supported in the
long run.  I see little reason to think that that risk would be less
for some random not-written-in-C implementation.  If we want to
jump ship away from libxml2, we had better ask hard questions about
the new choice.

            regards, tom lane



pgsql-hackers by date:

Previous
From: Pavel Stehule
Date:
Subject: Re: libxml2 author overwhelmed with security requests
Next
From: Michael Paquier
Date:
Subject: Re: Issues with 2PC at recovery: CLOG lookups and GlobalTransactionData