Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1rxWiI-009RLM-Ua for pgsql-admin@arkaria.postgresql.org; Thu, 18 Apr 2024 18:42:27 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1rxWiH-008QsL-Bu for pgsql-admin@arkaria.postgresql.org; Thu, 18 Apr 2024 18:42:25 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1rxWiG-008QsD-T4 for pgsql-admin@lists.postgresql.org; Thu, 18 Apr 2024 18:42:25 +0000 Received: from mout.kundenserver.de ([217.72.192.75]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1rxWiD-003UiM-4T for pgsql-admin@lists.postgresql.org; Thu, 18 Apr 2024 18:42:23 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=msym.fr; s=s1-ionos; t=1713465738; x=1714070538; i=msalais@msym.fr; bh=0JVeFVrODTZdxN8KI31wEouEFMgnHajXUJUtj6t62rk=; h=X-UI-Sender-Class:From:To:References:In-Reply-To:Subject:Date: Message-ID:MIME-Version:Content-Type:cc:content-transfer-encoding: content-type:date:from:message-id:mime-version:reply-to:subject: to; b=nxi28THiZW2XWuuxR4DctrM+YprrBFOOW4FeLQ85InHctwEq3ikqTFRNRKSsNlgh mgPqkr9Kw/VbjgSlhAJLYOCaYtq1h7MK8dE1fetF0DwZaCrshrNT7ACuRGSgqa8PZ VG+K8RlDLGearF0X/SHdnAvF7Nna1b+MyBEWYfSjMJpjny4JZbD0ZI8qEGpKXXjTC cFZxPmJ7sfSsXPPip7jkjslNnYEWqgZzwWkdzBK+Aycup3vxTcLR6A+1mToUuCFkE BAlQzPNV6GrN1sSLzIK7AnGYgZ4Dpp1NQloszSlfMbywE/HnYr8iETGxx7rk7+KWg iyKdGolTl3ueAj+38g== X-UI-Sender-Class: 55c96926-9e95-11ee-ae09-1f7a4046a0f6 Received: from msim1 ([78.197.128.121]) by mrelayeu.kundenserver.de (mreue109 [212.227.15.184]) with ESMTPSA (Nemesis) id 1N63NW-1smAMs3B3g-016QpZ for ; Thu, 18 Apr 2024 20:42:18 +0200 From: To: References: In-Reply-To: Subject: RE: A flaw in treating WITH CHECK OPTION views Date: Thu, 18 Apr 2024 20:42:17 +0200 Message-ID: <000c01da91c0$23ccbea0$6b663be0$@msym.fr> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000D_01DA91D0.E755DCC0" X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdqRXW9Y9SEMwVNaTLCOiM0a8fvL7AAYmsAA Content-Language: fr X-Provags-ID: V03:K1:V9Dc1tA5B1fTSDFGiyqMN6IXHg7UYaGEqZjBC1jO8x17rKVNFAy 8aAOk7JgrXSRT86cyvszUHvplB/ZmWbybh7QjTgNY2jid3gjVdbRf1Ae3Xw2Zd5sOdchi9c a4Wg9DmgiR0C2qkMPLVO19IiYqy+Lvswurn4XP6kH+ahV6pLj61Rd2tjm/6RXXwv2wJrXHA x2hYyiNx53iC2UZunD0Vg== X-Spam-Flag: NO UI-OutboundReport: notjunk:1;M01:P0:VNpv5+BUF68=;52xKKg0aA5k+TSqN83FWULaTj3w Ql/0BeEES8yZwkO+6VP10iwi+HOeJoR6IFTNKs8CW12qKDPeYqxI7p4Dh//GJZ9010p0kdYzg ncrmCYqjay+LuLh+Nm5KeH+AUzURgSiBSagCtwnUbizwSRokcywGUT4dAhcwyDqhS7IgB0+wp GB+oAdvovUMg+Y6TdybXapI+KwIb4zyVPZV5bbUx8J3X/J606ahkdLw4u1Yp7hVD9F1R/3mkr h/8/VZYkdcsNOB4SwU2meaQS40XUJtYX6E3ixotnob7tCTbSiTWJav44zNQQMNJcYesJbWmWS ahzjGtLYzU1hQjASrRMQAS1upPzCEdlitJiAnqSD8o8d7DJ+P4Hzn9RhwIQyz35Utb+Lwpxk8 sCHZci/vsdndHMb4gMTf5Xnav6WmooVMOsDFCkkd0FCxjdyNDI8zOG0HXAJlz1MuBGa8yS+UW TiX3LpG48KaXVdSRjVhu/0hQPMHXXIln9nc4SvkE3eT+t8rnNhNu5GIPKYccM3aCNz+6C/A3A lgv4/6/hhRFD4BZqV8miNAhuXNGfi+V9r+Mc8aIEhm9Kz7wFLByoNKX+frlbEaG1sNZ6MuwJc Hl0XuJzcZybVfUYdJI5PmIdbO6WQiCAvGW/GlhH+gXMuQxbWpafc1xHEexnUIcVMHK8q5D4II cfgCdaTb4XQ6VhZuhi/0lfZ2L0Xwd1IH7PM5In6NbgjXvFCLtk/tNXjXglhEQiB1s9kZTTxeg amD8o+y6uyIdhntlUHL+zarp1joUgl8Yk5tCUXsPXh06fAOW9gwPvY= List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk This is a multipart message in MIME format. ------=_NextPart_000_000D_01DA91D0.E755DCC0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Forget it I was Super User=85 I have modified the prompt for something else and then forgot that I = have modified it=85 =20 Michel SALAIS =20 De : msalais@msym.fr =20 Envoy=E9 : jeudi 18 avril 2024 20:35 =C0 : 'pgsql-admin@lists.postgresql.org' = Objet : A flaw in treating WITH CHECK OPTION views =20 Hi, I will demonstrate what I want with a little example msym=3D> create table t (c1 int, c2 int, c3 int); CREATE TABLE msym=3D> insert into t values (1, 1, 10),(2, 1, 10), (3, 2, 20), (4, 2, = 20); INSERT 0 4 msym=3D> create view v as select c1, c2 from t where c2 =3D 2 with check = option; CREATE VIEW msym=3D> select * from v; c1 | c2 ----+---- 3 | 2 4 | 2 (2 lignes) =20 msym=3D> update v set c2 =3D 3 where c1 =3D 3; ERROR: new row violates check option for view "v" DETAIL : Failing row contains (3, 3, 20). =20 =20 Suppose that view use is exactly to hide value of c3! This example shows = a security issue. =20 Best regards =20 Michel SALAIS ------=_NextPart_000_000D_01DA91D0.E755DCC0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Forget it

I was Super User…
I have = modified the prompt for something else and then forgot that I have = modified it…

 

Michel SALAIS

 

De := = msalais@msym.fr <msalais@msym.fr>
Envoy=E9 : jeudi = 18 avril 2024 20:35
=C0 : = 'pgsql-admin@lists.postgresql.org' = <pgsql-admin@lists.postgresql.org>
Objet : A flaw = in treating WITH CHECK OPTION views

 

Hi,

I will demonstrate what I want with = a little example

msym=3D> create table t = (c1 int, c2 int, c3 int);

CREATE TABLE

msym=3D> insert into t values (1, 1, = 10),(2, 1, 10), (3, 2, 20), (4, 2, 20);

INSERT 0 4

msym=3D> create view v as select c1, = c2 from t where c2 =3D 2 with check option;

CREATE VIEW

msym=3D> select * from = v;

c1 | c2

----+----

  3 |  = 2

  4 |  = 2

(2 lignes)

 

msym=3D> update v set c2 =3D 3 where = c1 =3D 3;

ERROR:  new row violates check = option for view "v"

DETAIL : Failing = row contains (3, 3, 20).

 

 

Suppose that view use is exactly to hide value of c3! This = example shows a security issue.

 

Best = regards

 

Michel SALAIS

------=_NextPart_000_000D_01DA91D0.E755DCC0--