pg.ddx.io pgsql-admin@postgresql.org mailing list archivehelp / color / mirror / Atom feed
A flaw in treating WITH CHECK OPTION views 2+ messages / 1 participants [nested] [flat]
* A flaw in treating WITH CHECK OPTION views @ 2024-04-18 18:35 msalais@msym.fr 0 siblings, 0 replies; 2+ messages in thread From: msalais@msym.fr @ 2024-04-18 18:35 UTC (permalink / raw) To: pgsql-admin@lists.postgresql.org Hi, I will demonstrate what I want with a little example msym=> create table t (c1 int, c2 int, c3 int); CREATE TABLE msym=> insert into t values (1, 1, 10),(2, 1, 10), (3, 2, 20), (4, 2, 20); INSERT 0 4 msym=> create view v as select c1, c2 from t where c2 = 2 with check option; CREATE VIEW msym=> select * from v; c1 | c2 ----+---- 3 | 2 4 | 2 (2 lignes) msym=> update v set c2 = 3 where c1 = 3; ERROR: new row violates check option for view "v" DETAIL : Failing row contains (3, 3, 20). Suppose that view use is exactly to hide value of c3! This example shows a security issue. Best regards Michel SALAIS ^ permalink raw reply [nested|flat] 2+ messages in thread
* RE: A flaw in treating WITH CHECK OPTION views @ 2024-04-18 18:42 msalais@msym.fr 0 siblings, 0 replies; 2+ messages in thread From: msalais@msym.fr @ 2024-04-18 18:42 UTC (permalink / raw) To: pgsql-admin@lists.postgresql.org Forget it I was Super User I have modified the prompt for something else and then forgot that I have modified it Michel SALAIS De : msalais@msym.fr <msalais@msym.fr> Envoyé : jeudi 18 avril 2024 20:35 À : 'pgsql-admin@lists.postgresql.org' <pgsql-admin@lists.postgresql.org> Objet : A flaw in treating WITH CHECK OPTION views Hi, I will demonstrate what I want with a little example msym=> create table t (c1 int, c2 int, c3 int); CREATE TABLE msym=> insert into t values (1, 1, 10),(2, 1, 10), (3, 2, 20), (4, 2, 20); INSERT 0 4 msym=> create view v as select c1, c2 from t where c2 = 2 with check option; CREATE VIEW msym=> select * from v; c1 | c2 ----+---- 3 | 2 4 | 2 (2 lignes) msym=> update v set c2 = 3 where c1 = 3; ERROR: new row violates check option for view "v" DETAIL : Failing row contains (3, 3, 20). Suppose that view use is exactly to hide value of c3! This example shows a security issue. Best regards Michel SALAIS ^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2024-04-18 18:42 UTC | newest] Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2024-04-18 18:35 A flaw in treating WITH CHECK OPTION views msalais@msym.fr 2024-04-18 18:42 RE: A flaw in treating WITH CHECK OPTION views msalais@msym.fr
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox