MIME-Version: 1.0
Sender: calvinguo@gmail.com
From: Calvin Guo <newoakllc2023@gmail.com>
Date: Mon, 24 Nov 2025 16:15:03 +0800
Message-ID: <CA+bysH_or91tt7r0gKLJtw5Wp+DEYwnaRJoTvLfKO33dcdQ_rQ@mail.gmail.com>
Subject: set role command
To: pgsql-general@lists.postgresql.org
Content-Type: multipart/alternative; boundary="00000000000035f7db064452c3be"
Archived-At: <https://www.postgresql.org/message-id/CA%2BbysH_or91tt7r0gKLJtw5Wp%2BDEYwnaRJoTvLfKO33dcdQ_rQ%40mail.gmail.com>
Precedence: bulk

--00000000000035f7db064452c3be
Content-Type: text/plain; charset="UTF-8"

I feel that set role logic is kindof misleading.

I am a superuser, admin,
I do:
set role usera
Now I am under the security context of usera, so I think running any sql is
safe as long as it's allowed by usera.

Which is not the case!
as usera can do:
set role userb; other sql,
or
reset role; orther sql,
it turns out it's not safe at all, the sql can easily get access right of
the super user. it can impernate userb though they do not have any
relationship whatso ever.

I really feel, once you "set role usera", you should behave like usera, you
should NOT have the power say: hi, I can assume my super user power
whenever I want. As this make the "set role usera" pretty much useless.

It's unsafe!

--00000000000035f7db064452c3be
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">I feel that set role logic is kindof misleading.<div><br><=
/div><div>I am a superuser, admin,</div><div>I do:</div><div>set role usera=
</div><div>Now I am under the security context of usera, so I think running=
 any sql is safe as long as it&#39;s allowed by usera.</div><div><br></div>=
<div>Which is not the case!</div><div>as usera can do:</div><div>set role u=
serb; other sql,</div><div>or=C2=A0</div><div>reset role; orther sql,</div>=
<div>it turns out it&#39;s not safe at all, the sql can easily get access r=
ight of the super user. it can impernate userb though they do not have any =
relationship whatso ever.</div><div><br></div><div>I really feel, once you =
&quot;set role usera&quot;, you should behave like usera, you should NOT ha=
ve the power say: hi, I can assume my super user power whenever I want. As =
this make the &quot;set role usera&quot; pretty much useless.</div><div><br=
></div><div>It&#39;s unsafe!</div></div>

--00000000000035f7db064452c3be--