Message-ID: <163428cd3f4bb3894ae86ed3278f320442ec41e1.camel@j-davis.com>
Subject: Re: [16+] subscription can end up in inconsistent state
From: Jeff Davis <pgsql@j-davis.com>
To: Amit Kapila <amit.kapila16@gmail.com>
Cc: pgsql-bugs@postgresql.org, Robert Haas <robertmhaas@gmail.com>
Date: Tue, 12 Sep 2023 13:33:57 -0700
In-Reply-To: 
 <CAA4eK1JC_wmBvfZuvimcmXuoG6LLKA5Xju5LAQDnJW_SfD-efA@mail.gmail.com>
References: <e5892973ae2a80a1a3e0266806640dae3c428100.camel@j-davis.com>
	 <CAA4eK1LJEMfdxpV7xDhR3qOFoSt3LuKbbu5kRMBfYJ2imT8Few@mail.gmail.com>
	 <5dff4caf26f45ce224a33a5e18e110b93a351b2f.camel@j-davis.com>
	 <CAA4eK1JC_wmBvfZuvimcmXuoG6LLKA5Xju5LAQDnJW_SfD-efA@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.44.4-0ubuntu2 
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/163428cd3f4bb3894ae86ed3278f320442ec41e1.camel%40j-davis.com>
Precedence: bulk

On Tue, 2023-09-12 at 16:13 +0530, Amit Kapila wrote:
> Do we want to remove
> that as anyway, we will do that check via walrcv_connect()?

I think we should keep the DDL-time checks in place as a best-effort,
but not rely on them for security.

> Another point is that if we want to unify such a check at the time of
> walrcv_connect() then do we need to do it at the time of Alter
> Subscription? I think it will probably be better to catch the problem
> early

Agreed. Catching mistakes at DDL time is a better user experience.

>  but does removing it from Alter Subscription time and doing it
> at connect time lead to security hazards?

We'd still be doing the same check, just later, right? If so there's
not a big security risk in removing the DDL-time checks. But it's
probably not a good idea to have non-superuser-owned subscriptions
without a password specified, so there may be some hazard there.

>=20
Regards,
	Jeff Davis