Re: Numeric is not leakproof

Stephen Frost <[email protected]> Tue, 3 Dec 2019 15:43:11 -0500

Newsgroups	gmane.comp.db.postgresql.bugs
Message-ID	<[email protected]>

Greetings,

* Konstantin Knizhnik ([email protected]) wrote:
> Numeric functions are not marked as leakproof in pg_proc.dat
> It cause unexpected behavior in case of using row-level security:

The behavior you're getting is *entirely* expected, just to be clear.
Perhaps unfortunate and not as performant as you were hoping, but
definitely not unexpected.

As Tom noted downthread, you can't just mark things 'leakproof' because
you want them to be able to be used in an index- you need to actually
show that they're leakproof.

> I have not checked all other builtin type.
> But it seems to me that it may be reasonable to mark ALL builtin functions
> (described in pg_proc.dat) as leekprof by default.

Absolutely not without careful verification of each and every one.
There's nothing that guarantees builtins are leakproof (and indeed,
there's no shortage of ones that are clearly *not* leakproof today).

I'd love it for someone to go through and fix them all to actually be
leakproof (or at least all of the ones that might be used with an index)
but that clearly hasn't been done here.

Thanks,

Stephen

signature.asc (application/pgp-signature, 819 B)