|
|
|
|
@ -1876,7 +1876,7 @@ SELECT * FROM phone_number WHERE tricky(person, phone); |
|
|
|
|
When it is necessary for a view to provide row-level security, the |
|
|
|
|
<literal>security_barrier</literal> attribute should be applied to |
|
|
|
|
the view. This prevents maliciously-chosen functions and operators from |
|
|
|
|
being invoked on rows until afterthe view has done its work. For |
|
|
|
|
being invoked on rows until after the view has done its work. For |
|
|
|
|
example, if the view shown above had been created like this, it would |
|
|
|
|
be secure: |
|
|
|
|
<programlisting> |
|
|
|
|
@ -1893,7 +1893,7 @@ CREATE VIEW phone_number WITH (security_barrier) AS |
|
|
|
|
<para> |
|
|
|
|
It is important to understand that even a view created with the |
|
|
|
|
<literal>security_barrier</literal> option is intended to be secure only |
|
|
|
|
in the limited sense that the contents of the invisible tuples will not |
|
|
|
|
in the limited sense that the contents of the invisible tuples will not be |
|
|
|
|
passed to possibly-insecure functions. The user may well have other means |
|
|
|
|
of making inferences about the unseen data; for example, they can see the |
|
|
|
|
query plan using <command>EXPLAIN</command>, or measure the runtime of |
|
|
|
|
|