From: Tom Lane <tgl@sss.pgh.pa.us>
To: fuboat@outlook.com
cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18496: Strange Handling for Circular Views and Permissions
 in PostgreSQL
In-reply-to: <18496-62ecca730bfdfceb@postgresql.org>
References: <18496-62ecca730bfdfceb@postgresql.org>
Comments: In-reply-to PG Bug reporting form <noreply@postgresql.org>
	message dated "Thu, 06 Jun 2024 07:12:08 -0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1025640.1717690588.1@sss.pgh.pa.us>
Date: Thu, 06 Jun 2024 12:16:28 -0400
Message-ID: <1025641.1717690588@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/1025641.1717690588%40sss.pgh.pa.us>
Precedence: bulk

PG Bug reporting form <noreply@postgresql.org> writes:
> When a user without SELECT permissions tries to perform a select operation
> on a circular view, PostgreSQL will report an error saying "infinite
> recursion detected in rules for relation v2" instead of "permission denied
> for view v2". Is this a bug or an unexpected behavior?

[ shrug... ]  Neither, I'd say.  There are no specific restrictions on
the order in which error checks are performed.

> Regardless, a circular view is an invalid view and should not appear in
> normal scenarios, so reporting this error message does not have any negative
> impact. However, should this error take precedence over the SELECT
> permission error, and could some important error messages potentially be
> leaked in this way to users without permissions?

It's hard to see how this leaks any information that's not
readily available to everybody from the system catalogs
(ie, "\d+ v1" and "\d+ v2").

			regards, tom lane