block/check-safety
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

rawsql: allow FROM pg_roles admin catalog lookup

Browse Source 
The wasm per-plugin role provisioner (cms role_provisioner.go, WO-WZ-007)
checks role existence with a parameterized `SELECT ... FROM pg_roles`.
That is a Postgres administrative catalog lookup (DCL provisioning, not
sqlc-able), the same category as the already-allowed `FROM pg_database`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Alex Dunmow 2026-07-03 16:36:58 +08:00
parent bba5946bb1
commit 40d33d0587
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
rawsql.go
View File

@ -36,6 +36,7 @@ func isRawSQLAllowed(path string) bool {
var allowedSQLPatterns = []string{ var allowedSQLPatterns = []string{
"pg_terminate_backend", // backup_service.go — kills connections before restore "pg_terminate_backend", // backup_service.go — kills connections before restore
"FROM pg_database", // Administrative catalog lookup for tenant database existence "FROM pg_database", // Administrative catalog lookup for tenant database existence
"FROM pg_roles", // role_provisioner.go — per-plugin role existence lookup (DCL, not sqlc-able)
} }
func isSQLAllowed(sql string) bool { func isSQLAllowed(sql string) bool {