Skip to content

Commit

Permalink
Warn about C security definer functions without search_path
Browse files Browse the repository at this point in the history
Treat C security definer function similar to how we treat non-C
functions and generate the same warning.
  • Loading branch information
svenklemm committed Apr 21, 2024
1 parent ceb83c7 commit c3e17d6
Show file tree
Hide file tree
Showing 3 changed files with 4 additions and 3 deletions.
2 changes: 1 addition & 1 deletion src/pgspot/visitors.py
Original file line number Diff line number Diff line change
Expand Up @@ -240,7 +240,7 @@ def visit_CreateFunctionStmt(self, ancestors, node):

# functions without explicit search_path will generate a warning
# unless they are SECURITY DEFINER
if security and language != "c":
if security:
if not setter:
self.state.error("PS003", format_function(node))
elif not body_secure:
Expand Down
3 changes: 2 additions & 1 deletion testdata/expected/security_definer.out
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ PS005: Function without explicit search_path: safe_sec_invoker4() at line 3
PS003: SECURITY DEFINER function without explicit search_path: unsafe_sec_definer6() at line 5
PS005: Function without explicit search_path: safe_sec_definer8() at line 7
PS003: SECURITY DEFINER function without explicit search_path: unsafe_sec_definer10() at line 9
PS003: SECURITY DEFINER function without explicit search_path: c_sec_definer12() at line 11

Errors: 3 Warnings: 3 Unknown: 0
Errors: 4 Warnings: 3 Unknown: 0

2 changes: 1 addition & 1 deletion testdata/security_definer.sql
Original file line number Diff line number Diff line change
Expand Up @@ -8,5 +8,5 @@ CREATE FUNCTION unsafe_sec_definer6() RETURNS TEXT LANGUAGE PLPGSQL SECURITY DEF
CREATE FUNCTION safe_sec_definer8() RETURNS TEXT LANGUAGE PLPGSQL SECURITY INVOKER AS $$ BEGIN RETURN pg_catalog.now(); END; $$;
-- unsafe plpgsql sec definer procedure with no search_path
CREATE PROCEDURE unsafe_sec_definer10() LANGUAGE PLPGSQL SECURITY DEFINER AS $$ BEGIN PERFORM pg_catalog.now(); END; $$;
-- we dont warn about search_path of security definer function in C
-- security definer function in C without search_path
CREATE FUNCTION c_sec_definer12() RETURNS TEXT LANGUAGE C SECURITY DEFINER AS 'c_sec_definer12';

0 comments on commit c3e17d6

Please sign in to comment.