From: msalais@msym.fr
To: pgsql-admin@lists.postgresql.org
Subject: A flaw in treating WITH CHECK OPTION views
Date: Thu, 18 Apr 2024 20:35:02 +0200
Message-ID: <000501da91bf$20e2b380$62a81a80$@msym.fr> (raw)
Hi,
I will demonstrate what I want with a little example
msym=> create table t (c1 int, c2 int, c3 int);
CREATE TABLE
msym=> insert into t values (1, 1, 10),(2, 1, 10), (3, 2, 20), (4, 2, 20);
INSERT 0 4
msym=> create view v as select c1, c2 from t where c2 = 2 with check option;
CREATE VIEW
msym=> select * from v;
c1 | c2
----+----
3 | 2
4 | 2
(2 lignes)
msym=> update v set c2 = 3 where c1 = 3;
ERROR: new row violates check option for view "v"
DETAIL : Failing row contains (3, 3, 20).
Suppose that view use is exactly to hide value of c3! This example shows a
security issue.
Best regards
Michel SALAIS
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: msalais@msym.fr, pgsql-admin@lists.postgresql.org
Subject: Re: A flaw in treating WITH CHECK OPTION views
In-Reply-To: <000501da91bf$20e2b380$62a81a80$@msym.fr>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox