Shay Rojansky <roji@roji.org> writes:
>> Yeah, it's fairly hard to see how we could respond to this complaint
>> without lobotomizing our error messages to the point of near uselessness.
>> Almost any non-constant text in an error report could possibly be seen
>> as hazardous.
> I don't think that's true - schema information (table, column names)
> definitely seems like it's in a different category than table contents.
You're not visualizing this with the appropriate amount of paranoia: just
because the database thinks that something is a table or column name
doesn't mean that that's what it actually is. A screw-up in query syntax
could lead to reporting back something that was really a data value.
Admittedly, that's not very likely given a well-debugged application
issuing the queries, but it's not something to ignore either.
> First, there are many lazily-written applications out there which simply
> show exception/error messages to users. So user A could interact with a
> website in a way that triggers a unique constraint violation, and thereby
> get access to the data in the row which caused the violation.
Well, that's just bad webapp design ...
> Second, such exceptions and errors frequently get logged (e.g. to disk).
> Logs in general aren't kept as secure as database data itself (who knows
> where they end up and who handles them).
Yeah. We more commonly see this type of complaint in the alternate guise
of "you're logging sensitive information in the postmaster log! I can't
accept that!". We've basically established a project policy that the
postmaster log has to be secured to exactly the same extent as the
database files themselves, since otherwise there's no certainty that it
won't leak data you don't want leaked. On the whole, I think the right
response to this complaint is that equal attention has to be given to
securing error logs on the client side.
regards, tom lane
