Re: Limiting the operations that client-side code can perform upon its database backend's artifacts - Mailing list pgsql-general

From Julien Rouhaud
Subject Re: Limiting the operations that client-side code can perform upon its database backend's artifacts
Date
Msg-id 20220927065858.ibrmzrrbefjq5o4l@jrouhaud
Whole thread Raw
In response to Limiting the operations that client-side code can perform upon its database backend's artifacts  (Bryn Llewellyn <bryn@yugabyte.com>)
Responses Re: Limiting the operations that client-side code can perform upon its database backend's artifacts
Re: Limiting the operations that client-side code can perform upon its database backend's artifacts
List pgsql-general
On Mon, Sep 26, 2022 at 11:18:34AM -0700, Bryn Llewellyn wrote:
>
> My demo seems to show that when a program connects as "client", it can
> perform exactly and only the database operations that the database design
> specified.
>
> Am I missing something? In other words, can anybody show me a vulnerability?

What exactly prevents the client role from inserting e.g.

- 'robert''); drop table students; --'
- millions of 'cat' rows
- millions of 1GB-large rows

or just keep sending massive invalid query texts to fill the logs, or just
trying to connect until there's no available connection slots anymore, and then
keep spamming the server thousands of time per second to try to open new
connections, or ...?



pgsql-general by date:

Previous
From: Andreas Kretschmer
Date:
Subject: Re: Findout long unused tables in database
Next
From: Andreas Fröde
Date:
Subject: Re: Findout long unused tables in database