Security definer views should be allowed in certain conditions

未关闭
  • 哪里不对？
#140 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
38/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
冷清
技术栈
postgres
领域
databases, security

调研方向

首先在 PostgreSQL 中复现 SQL 草图，并检查 linter 当前如何标记 security definer views。将提议的 security_barrier 和 SELECT-only grant conditions 与现有行为进行比较；完成的标准是 qualifying views 会被允许，或降级为可忽略的警告，同时不允许不安全的变更操作。

由索引模型根据 Issue 内容生成。

描述

bug

Bug report

  • I confirm this is a bug with Supabase, not with my own application.
  • I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

"security definer" views are flagged as an error.

There are cases where RLS is not the right tool for the job, such as where the per-row checks are very expensive, or where certain columns should not be shown to the user. Postgres has two features I can think of that are helpful here:

  1. A view with security_invoker=true that calls a security definer function
  2. A view wth secuity_invoker=false, secuirty_barrier=true

This is touched on in #98, but the discussion focussed on dismissing the error.

I believe the correct behaviour is to allow security definer views if the following conditions are met:

  1. security_barrier=true – this prevents predicate injection
  2. grant is limited to select operation only – this prevents mutating the base table if the view is a simple view

Given the intention is to take away footguns from the user base, a warning that could be dismissed also seems fine.

Sketch

To verify the behaviour:

create schema app;

create table app.test (
  id uuid primary key default gen_random_uuid(),
  slug text unique
);

-- optionally
-- alter table app.test enable row level security;

create view app.test_v as select * from app.test;

create role app_user;
grant app_user to postgres;

revoke all privileges on app.test from app_user;
revoke all privileges on app.test_v from app_user;

-- if RLS is enabled
-- grant select on app.test 

grant select on app.test_v to app_user;
grant usage on schema app to app_user;

-- security vulnerability (simple views only)
-- grant insert, update, delete on app.text_v to app.user;

set role app_user; 

select * from app.test; -- ERROR: permission denied for table test
select * from app.test_v; -- rows
insert into app.test_v (slug) values ('hello'); -- ERROR:  permission denied for view test_v

reset role;
主要语言
PLpgSQL
星标
284
派生
110
30 天内没有已合并 PR

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

supabase/splinter 的其他 Issue

查看 supabase/splinter 的全部 Issue

相似的 Issue

更多 Databases Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。