Proposal update to make it where Supabase rule 0029 will skip functions whose body matches a reasonable "gated" heuristic - e.g. contains a check on 'auth.uid( )', 'has_role', 'is_admin', or equivalent.

未关闭
  • 哪里不对？
#172 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
35/100
Issue 类型
功能
描述清晰度
需要澄清
活跃度
冷清
技术栈
postgres
领域
databases, security

调研方向

首先定位规则 0029_authenticated_security_definer_function_executable 的实现和测试；payload 没有指定具体文件。比较 heuristic、SQL comment opt-out 和 config allowlist 这几种提案，然后在开始编码前确认 maintainers 希望采用哪种方向。完成的标准是：选定的 suppression behavior 已实现并有测试覆盖，同时不会隐藏真正不安全的函数。

由索引模型根据 Issue 内容生成。

描述

documentation

Title

0029: allow opt-in suppression for SECURITY DEFINER functions that self-gate the caller

Body

Summary

Rule 0029_authenticated_security_definer_function_executable flags every SECURITY DEFINER function in the exposed API schema that is executable by authenticated. In codebases that legitimately rely on definer RPCs for cross-user reads, RPC-only tables, and rate-limit counters, this produces a large number of warnings that cannot be resolved without either (a) removing DEFINER and breaking the RPC's purpose, or (b) revoking EXECUTE from authenticated and moving the call off the Data API.

Both options are unattractive for the common pattern where a definer function is the gate:

CREATE OR REPLACE FUNCTION public.mp_end_room_v2(p_game_id uuid, p_reason text)
RETURNS void LANGUAGE plpgsql SECURITY DEFINER
SET search_path = 'public' AS $$
DECLARE v_uid uuid := auth.uid();
BEGIN
  IF v_uid IS NULL THEN RETURN; END IF;
  -- ...participant check against mp_games...
  UPDATE public.mp_games SET status = 'ended' WHERE id = p_game_id
    AND (host_user_id = v_uid OR guest_user_id = v_uid);
END $$;

This function needs DEFINER because it mutates the opponent's row in mp_games; it self-gates via auth.uid() and a participant check. There is no safe alternative: SECURITY INVOKER would fail RLS, and revoking EXECUTE FROM authenticated would make the game unplayable.

Concrete data point

In a game project with ~40 definer RPCs (matchmaking, chat, ranked Elo, spectator flow), rule 0029 flags 33+ functions. After a manual audit, all 33 were confirmed as intentionally-gated definers. The signal-to-noise ratio for this rule in that codebase is effectively 0%.

Proposals (any one would help)

Option A — Heuristic: Skip functions whose body references any of auth.uid(), auth.jwt(), public.has_role(, is_admin(, or RAISE EXCEPTION within the first N statements. False positives are still possible, but the rule stops firing on the common "check-then-act" pattern.

Option B — Explicit opt-out via COMMENT: Skip functions whose Postgres comment matches a marker such as lint:0029-safe. Example:

COMMENT ON FUNCTION public.mp_end_room_v2(uuid, text)
  IS 'lint:0029-safe — participant check via auth.uid() inside body';

This is the same escape-hatch pattern many linters use (# noqa, // eslint-disable) and gives auditors a searchable marker in the source.

Option C — Config-driven allowlist: Support a project-level allowlist (e.g. an entry in supabase/config.toml or a magic table public._splinter_ignore) that lists function names to skip.

Option B is the least invasive and the most auditable. Option A alone would already remove most noise.

Why this matters

Right now, teams doing the right thing (definer RPCs for privileged writes, self-gated with auth.uid()) are indistinguishable in the linter output from teams that accidentally left a definer function exposed. That creates alert fatigue on 0029 and pushes teams toward either ignoring the whole rule or maintaining out-of-band allowlists. Any of the three options above would let 0029 flag only the risky definers, which is what the rule was intended to catch.

Happy to contribute a PR for option B if there's interest.

主要语言
PLpgSQL
星标
284
派生
110
30 天内没有已合并 PR

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

supabase/splinter 的其他 Issue

查看 supabase/splinter 的全部 Issue

相似的 Issue

更多 Databases Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。