Re: lastval exposes information that currval does not

On Wed, Jul 05, 2006 at 08:06:12PM -0400, Chris Campbell wrote:
> On Jul 5, 2006, at 14:51, Phil Frost wrote:
>
> >test=# create function bump() returns bigint language sql security
> >definer as $$ select nextval('private.seq'); $$;
>
> SECURITY DEFINER means that the function runs with the permissions of
> the role used to create the function (ran the CREATE FUNCTION
> command). Due to your # prompt, I'm guessing that you were a
> superuser when you ran this command. Thus, bump() will be run with
> the superuser's permissions.
>
> The superuser most definitely has permissions to access private.seq.
>
> This has nothing to do with schema security or lastval() versus
> currval().
>
> Check out the CREATE FUNCTION documentation:
>
> http://www.postgresql.org/docs/8.1/interactive/sql-
> createfunction.html

I am well aware of what security definer means. The significant part of
this example is that lastval() will allow the caller to see the value of
a sequence where currval('seq') will not. This means that things which
might have been forbidden in 8.0 are now accessible in 8.1.

It also means that revoking usage on a schema is not sufficient to
prevent a user from accessing things within that schema, a property that
makes me quite uncomfortable.