public inbox for [email protected]
help / color / mirror / Atom feedFrom: Joe Conway <[email protected]>
To: Tom Lane <[email protected]>
Cc: Jacob Champion <[email protected]>
Cc: Robert Haas <[email protected]>
Cc: Andrew Dunstan <[email protected]>
Cc: David Rowley <[email protected]>
Cc: PostgreSQL Hackers <[email protected]>
Subject: Re: can we mark upper/lower/textlike functions leakproof?
Date: Fri, 2 Aug 2024 12:13:31 -0400
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>
References: <[email protected]>
<CAApHDvr36T+9XZYTRkHkGm82Wo5YY6wXwkRDceu2-cyGEvHzjw@mail.gmail.com>
<[email protected]>
<[email protected]>
<CA+Tgmob78LN+Tkgms=dQyBsLyGWBuehv7_kEvBfjwmj6fDsr7g@mail.gmail.com>
<[email protected]>
<CA+TgmoaR59Jjhr5o1BXuzHd1zfuzz-nL79Uj5D8MD34cde1hDg@mail.gmail.com>
<CAOYmi+kq95mTCLmQK1-0bPpuKoGF67RFjqdUhCn=i2NFFi-0Yw@mail.gmail.com>
<CA+TgmobL10X-HWMpvGY4kRff8FzAdNvjDU0aJeWQE-RQTLr-=g@mail.gmail.com>
<CAOYmi+kxckoOq0Be6sasD6NP54iczO8yDguWWZ_FXrMb+Cyt0Q@mail.gmail.com>
<[email protected]>
<[email protected]>
On 8/2/24 11:07, Tom Lane wrote:
> Joe Conway <[email protected]> writes:
>> <dons flameproof suit>
>> Hmmm, and then have "leakproof_mode" = strict/lax/off where 'strict' is
>> current behavior, 'lax' allows the 'maybe's to get pushed down, and
>> 'off' ignores the leakproof attribute entirely and pushes down anything
>> that merits being pushed?
>> </dons flameproof suit>
>
> So in other words, we might as well just remove RLS.
Perhaps deciding where to draw the line for 'maybe' is too hard, but I
don't understand how you can say that in a general sense.
'strict' mode would provide the same guarantees as today. And even 'off'
has utility for cases where (1) no logins are allowed except for the app
(which is quite common in production environments) and no database
errors are propagated to the end client (again pretty standard best
practice); or (2) non-production environments, e.g. for testing or
debugging; or (3) use cases that utilize RLS as a notationally
convenient filtering mechanism and are not bothered by some leakage in
the worst case.
--
Joe Conway
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com
view thread (29+ messages) latest in thread
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Subject: Re: can we mark upper/lower/textlike functions leakproof?
In-Reply-To: <[email protected]>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox