public inbox for [email protected]  

help / color / mirror / Atom feed

From: Heikki Linnakangas <[email protected]>
To: Lars Olson <[email protected]>
Cc: [email protected]
Subject: Re: BUG #4074: Using SESSION_USER or CURRENT_USER in a view definition is unsafe
Date: Mon, 31 Mar 2008 22:36:54 +0100
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>
References: <[email protected]>

Lars Olson wrote:
> Creating a view that depends on the value of SESSION_USER enables a
> minimally-privileged user to write a user-defined function that contains a
> trojan-horse to get arbitrary data from the base table.  Using CURRENT_USER
> instead still enables a similar vulnerability.
> 
> To reproduce the problem, create three users, alice (base table owner), bob
> (attacker), and carol (other minimally-privileged user).  As Alice, create
> the following table and view:
> ...

This seems to be an instance of the general trojan-horse problem 
discussed here:

http://archives.postgresql.org/pgsql-hackers/2008-01/msg00268.php

In a nutshell, it's just not safe to access a view or function owned by 
a user you don't trust. :-(

-- 
   Heikki Linnakangas
   EnterpriseDB   http://www.enterprisedb.com

view thread (6+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: BUG #4074: Using SESSION_USER or CURRENT_USER in a view definition is unsafe
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox