public inbox for [email protected]  

help / color / mirror / Atom feed

From: Adrian Klaver <[email protected]>
To: David G. Johnston <[email protected]>
Cc: Dominique Devienne <[email protected]>
Cc: Guillaume Lelarge <[email protected]>
Cc: [email protected] <[email protected]>
Subject: Re: SET LOCAL ROLE inside SECURITY INVOKER (LANGUAGE plpgsql) function
Date: Thu, 31 Jul 2025 08:45:46 -0700
Message-ID: <[email protected]> (raw)
In-Reply-To: <CAKFQuwap0B96VNsVJVbyP3h1FPAGz0f=SOi_Gcf9PBM1id2HFg@mail.gmail.com>
References: <CAFCRh--AXoYUj8-WDuWpUcWXC0UNAL9gjbTp=1hU-NJhRyR0vQ@mail.gmail.com>
	<[email protected]>
	<CAFCRh-9AzsOBd6cPFsgmbw=Mf3nN5tHj9YYQQHZG0XqxDSMK=Q@mail.gmail.com>
	<[email protected]>
	<[email protected]>
	<CAFCRh-8D+R=xufTFYN8SDDeEVwDNCb7kcspt9hsRW2T-QOMoKg@mail.gmail.com>
	<[email protected]>
	<CAFCRh--tSWRRCMvtSovtRDX1wce5KCOutaDRBD5JKWb9atLC_w@mail.gmail.com>
	<[email protected]>
	<CAKFQuwap0B96VNsVJVbyP3h1FPAGz0f=SOi_Gcf9PBM1id2HFg@mail.gmail.com>

On 7/31/25 08:06, David G. Johnston wrote:
> On Thursday, July 31, 2025, Adrian Klaver <[email protected] 
> <mailto:[email protected]>> wrote:

>     So the below from the original post was not correct:
> 
>     "My setup ensures that the role I SET LOCAL ROLE to, has (indirectly)
>     been granted DMLs on that table."
> 
> 
> Not incorrect, just insufficient since select is not a DML action.

1) Seems to be some difference on that:

https://www.contrib.andrew.cmu.edu/~shadow/sql/sql1992.txt

13  Data manipulation

13.5  <select statement: single row>

Function

          Retrieve values from a specified row of a table.

2) What if you do SELECT some_data_mod_fnc()?

3) In the case at hand there was an implied SELECT as part of the DELETE.

> 
> David J.
> 


-- 
Adrian Klaver
[email protected]

view thread (4+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected], [email protected], [email protected]
  Subject: Re: SET LOCAL ROLE inside SECURITY INVOKER (LANGUAGE plpgsql) function
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox