On Sat, May 24, 2025 at 2:39 PM Feike Steenbergen <feikesteenber...@gmail.com> wrote: > > The loophole is this: > > - the generated virtual column can use a user-defined function > - when running SELECT against that column by a superuser > the function is called within the context of a superuser > - this in turn allows the regular user to run any code within > the context of superuser
sorry, I am not fully sure what this means. a minimum sql reproducer would be great. you may check virtual generated column function privilege regress tests on https://git.postgresql.org/cgit/postgresql.git/tree/src/test/regress/sql/generated_virtual.sql#n284 (from line 284 to line 303) also see [1]. PostgreSQL grants EXECUTE privilege for functions and procedures to PUBLIC *by default* when the objects are created. [1]: https://www.postgresql.org/docs/current/ddl-priv.html#PRIVILEGES-SUMMARY-TABLE
