The set_user extension module prior to 3.0.0 for PostgreSQL allows ProcessUtility_hook bypass via set_config.
set user project set user