no-set-search-path · eslint-plugin-postgresql

Why this matters

`SET search_path` makes name resolution depend on session state — a known footgun for SECURITY DEFINER functions and `CREATE TABLE foo` statements that silently target a different schema. Qualify identifiers (`audit.events`, `public.users`) instead.

Examples

Incorrect

SET search_path TO audit, public;

Correct

SELECT id FROM audit.events;

Configure it

// eslint.config.js
import postgresql from "eslint-plugin-postgresql";

export default [
  {
    files: ["**/*.sql"],
    languageOptions: {
      parser: postgresql.configs.recommended.languageOptions.parser,
    },
    plugins: { postgresql },
    rules: {
      "postgresql/no-set-search-path": "warn",
    },
  },
];

Options

This rule has no options.

Edit the SQL — only no-set-search-path is enabled.

Pre-filled with the first incorrect example. Toggle off in the rule shelf to see how the diagnostic disappears.

Diagnostics

No issues found.

2 rules enabled.

Rule under test no-set-search-path — plus no-syntax-error as a safety net.