0025_public_bucket_allows_listing silently returns zero findings when splinter.public_buckets is unset — undocumented transaction-local contract

Abierto
  • ¿Algo no está bien?
#181 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@sidgaikwad ya está trabajando en esto.

Desde el 15/9/2026.

  • #190 de @sidgaikwad — abierto

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
45/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Tranquilo
Stack tecnológico
postgresql, sql
Área
databases, security

Línea de trabajo

Comienza con la consulta 0025_public_bucket_allows_listing y su preámbulo en el splinter.sql compilado, y después compara los campos query y setup separados en splinter.json. Revisa el README y la invocación de CI psql --single-transaction para documentar el contrato del GUC local a la transacción. Se considera terminado cuando una configuración ausente no puede producir silenciosamente un resultado limpio, con un comportamiento que cubra tanto la omisión de setup como una lista de buckets legítimamente vacía.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

Since #170 ("chore: 0025 query_to_xml workaround", merged 2026-07-02), 0025_public_bucket_allows_listing no longer reads storage.buckets itself. The view now reads a GUC:

coalesce(
    nullif(pg_catalog.current_setting('splinter.public_buckets', true), '')::pg_catalog.jsonb,
    '[]'::pg_catalog.jsonb
)

and the storage.buckets read moved into a preamble DO block that exists only in the compiled splinter.sql, which populates the GUC transaction-locally:

perform pg_catalog.set_config('splinter.public_buckets', buckets, true);

Consequence: any consumer that executes the lint query without running that preamble in the same transaction gets zero findings — indistinguishable from a genuinely clean result. The lint fails open. #170 itself had to switch this repo's CI runner to psql --single-transaction to keep the GUC visible, which illustrates the hazard: the contract is real, but it lives only in the compiled artifact and CI invocation, and the README documents the pgrst.db_schemas dependency while splinter.public_buckets is undocumented.

Real-world impact (hosted advisor path)

On our hosted project, 0025 reported two findings (user-avatars, workspace-branding) through 2026-06-10. Sometime after #170, the findings disappeared from the hosted security-advisor results while both flagged conditions still hold — we re-verified by executing the lint's own predicate manually with the bucket list supplied: both broad PERMISSIVE SELECT policies still exist and both findings reproduce exactly. We can't inspect the hosted advisor runner, but the observable symptom is precisely what a runner that doesn't execute the preamble in-transaction would produce, and no other 0025-touching change exists in the window.

For an advisor whose job is to flag data exposure, "input not supplied" being indistinguishable from "no exposure found" seems worth closing: consumers (including us) read the absence of findings as a clean bill.

The same hazard is now formalized in the manifest

The versioned splinter.json manifest publishes per-lint query fields with a separate setup field. A consumer that runs a lint's query without executing setup in the same transaction reproduces the same silent zero for 0025.

Prior art

This is the same failure class as the unset-pgrst.db_schemas case (supabase/cli#5868, fixed by #168 coalescing to 'public'). The difference: 0025 has no sane inline default available — an empty bucket list doesn't degrade the lint, it disables it silently.

Suggestions
  1. Document the splinter.public_buckets contract in the README alongside pgrst.db_schemas, including the transaction-local requirement.
  2. Prefer fail-loud over fail-open: when the setting is absent (as opposed to a legitimately empty []), either raise, or emit a sentinel "not evaluated" row, so runners that skip the preamble become visible instead of silently green.
  3. Alternatively, restore a self-contained fallback: read storage.buckets directly when the GUC is absent and the storage schema exists (the pre-#170 behavior), using whatever construction avoids the original query_to_xml problem that motivated #170.

Happy to provide the manual reproduction steps or test against a fix.

Lenguaje dominante
PLpgSQL
Estrellas
284
Forks
110
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de supabase/splinter

Todos los issues de supabase/splinter

Issues similares

Más issues de Databases

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.