Skip to content

Commit cd30728

Browse files
robertmhaasrobertmhaas
committed
Allow LEAKPROOF functions for better performance of security views.
We don't normally allow quals to be pushed down into a view created with the security_barrier option, but functions without side effects are an exception: they're OK. This allows much better performance in common cases, such as when using an equality operator (that might even be indexable). There is an outstanding issue here with the CREATE FUNCTION / ALTER FUNCTION syntax: there's no way to use ALTER FUNCTION to unset the leakproof flag. But I'm committing this as-is so that it doesn't have to be rebased again; we can fix up the grammar in a future commit. KaiGai Kohei, with some wordsmithing by me.
1 parent 2bbd88f commit cd30728

28 files changed

+3356
-2454
lines changed

‎doc/src/sgml/catalogs.sgml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4423,6 +4423,18 @@
44234423
function)</entry>
44244424
</row>
44254425

4426+
<row>
4427+
<entry><structfield>proleakproof</structfield></entry>
4428+
<entry><type>bool</type></entry>
4429+
<entry></entry>
4430+
<entry>
4431+
The function has no side effects. No information about the
4432+
arguments is conveyed except via the return value. Any function
4433+
that might throw an error depending on the values of its arguments
4434+
is not leakproof.
4435+
</entry>
4436+
</row>
4437+
44264438
<row>
44274439
<entry><structfield>proisstrict</structfield></entry>
44284440
<entry><type>bool</type></entry>

‎doc/src/sgml/ref/alter_function.sgml

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ ALTER FUNCTION <replaceable>name</replaceable> ( [ [ <replaceable class="paramet
3333
<phrase>where <replaceable class="PARAMETER">action</replaceable> is one of:</phrase>
3434

3535
CALLED ON NULL INPUT | RETURNS NULL ON NULL INPUT | STRICT
36-
IMMUTABLE | STABLE | VOLATILE
36+
IMMUTABLE | STABLE | VOLATILE | LEAKPROOF
3737
[ EXTERNAL ] SECURITY INVOKER | [ EXTERNAL ] SECURITY DEFINER
3838
COST <replaceable class="parameter">execution_cost</replaceable>
3939
ROWS <replaceable class="parameter">result_rows</replaceable>
@@ -191,6 +191,17 @@ ALTER FUNCTION <replaceable>name</replaceable> ( [ [ <replaceable class="paramet
191191
</listitem>
192192
</varlistentry>
193193

194+
<varlistentry>
195+
<term><literal>LEAKPROOF</literal></term>
196+
<listitem>
197+
<para>
198+
Change whether the function is considered leakproof or not.
199+
See <xref linkend="sql-createfunction"> for more information about
200+
this capability.
201+
</para>
202+
</listitem>
203+
</varlistentry>
204+
194205
<varlistentry>
195206
<term><literal>COST</literal> <replaceable class="parameter">execution_cost</replaceable></term>
196207

‎doc/src/sgml/ref/create_function.sgml

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ CREATE [ OR REPLACE ] FUNCTION
2626
| RETURNS TABLE ( <replaceable class="parameter">column_name</replaceable> <replaceable class="parameter">column_type</replaceable> [, ...] ) ]
2727
{ LANGUAGE <replaceable class="parameter">lang_name</replaceable>
2828
| WINDOW
29-
| IMMUTABLE | STABLE | VOLATILE
29+
| IMMUTABLE | STABLE | VOLATILE | LEAKPROOF
3030
| CALLED ON NULL INPUT | RETURNS NULL ON NULL INPUT | STRICT
3131
| [ EXTERNAL ] SECURITY INVOKER | [ EXTERNAL ] SECURITY DEFINER
3232
| COST <replaceable class="parameter">execution_cost</replaceable>
@@ -324,6 +324,23 @@ CREATE [ OR REPLACE ] FUNCTION
324324
</listitem>
325325
</varlistentry>
326326

327+
<varlistentry>
328+
<term><literal>LEAKPROOF</literal></term>
329+
<listitem>
330+
<para>
331+
<literal>LEAKPROOF</literal> indicates that the function has no side
332+
effects. It reveals no information about its arguments other than by
333+
its return value. For example, a function which throws an error message
334+
for some argument values but not others, or which includes the argument
335+
values in any error message, is not leakproof. The query planner may
336+
push leakproof functions (but not others) into views created with the
337+
<literal>security_barrier</literal> option. See
338+
<xref linkend="sql-createview"> and <xref linkend="rules-privileges">.
339+
This option can only be set by the superuser.
340+
</para>
341+
</listitem>
342+
</varlistentry>
343+
327344
<varlistentry>
328345
<term><literal>CALLED ON NULL INPUT</literal></term>
329346
<term><literal>RETURNS NULL ON NULL INPUT</literal></term>

‎doc/src/sgml/rules.sgml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1890,6 +1890,20 @@ CREATE VIEW phone_number WITH (security_barrier) AS
18901890
enabled by default.
18911891
</para>
18921892

1893+
<para>
1894+
The query planner has more flexibility when dealing with functions that
1895+
have no side effects. Such functions are referred to as LEAKPROOF, and
1896+
include many simple, commonly used operators, such as many equality
1897+
operators. The query planner can safely allow such functions to be evaluated
1898+
at any point in the query execution process, since invoking them on rows
1899+
invisible to the user will not leak any information about the unseen rows.
1900+
In contrast, a function that might throw an error depending on the values
1901+
received as arguments (such as one that throws an error in the event of
1902+
overflow or division by zero) are not leak-proof, and could provide
1903+
significant information about the unseen rows if applied before the security
1904+
view's row filters.
1905+
</para>
1906+
18931907
<para>
18941908
It is important to understand that even a view created with the
18951909
<literal>security_barrier</literal> option is intended to be secure only

‎src/backend/catalog/pg_aggregate.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -241,6 +241,7 @@ AggregateCreate(const char *aggName,
241241
false, /* isWindowFunc */
242242
false, /* security invoker (currently not
243243
* definable for agg) */
244+
false, /* isLeakProof */
244245
false, /* isStrict (not needed for agg) */
245246
PROVOLATILE_IMMUTABLE, /* volatility (not
246247
* needed for agg) */

‎src/backend/catalog/pg_proc.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ ProcedureCreate(const char *procedureName,
7676
bool isAgg,
7777
bool isWindowFunc,
7878
bool security_definer,
79+
bool isLeakProof,
7980
bool isStrict,
8081
char volatility,
8182
oidvector *parameterTypes,
@@ -334,6 +335,7 @@ ProcedureCreate(const char *procedureName,
334335
values[Anum_pg_proc_proisagg - 1] = BoolGetDatum(isAgg);
335336
values[Anum_pg_proc_proiswindow - 1] = BoolGetDatum(isWindowFunc);
336337
values[Anum_pg_proc_prosecdef - 1] = BoolGetDatum(security_definer);
338+
values[Anum_pg_proc_proleakproof - 1] = BoolGetDatum(isLeakProof);
337339
values[Anum_pg_proc_proisstrict - 1] = BoolGetDatum(isStrict);
338340
values[Anum_pg_proc_proretset - 1] = BoolGetDatum(returnsSet);
339341
values[Anum_pg_proc_provolatile - 1] = CharGetDatum(volatility);

‎src/backend/commands/functioncmds.c

Lines changed: 38 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -446,6 +446,7 @@ compute_common_attribute(DefElem *defel,
446446
DefElem **volatility_item,
447447
DefElem **strict_item,
448448
DefElem **security_item,
449+
DefElem **leakproof_item,
449450
List **set_items,
450451
DefElem **cost_item,
451452
DefElem **rows_item)
@@ -471,6 +472,13 @@ compute_common_attribute(DefElem *defel,
471472

472473
*security_item = defel;
473474
}
475+
else if (strcmp(defel->defname, "leakproof") == 0)
476+
{
477+
if (*leakproof_item)
478+
goto duplicate_error;
479+
480+
*leakproof_item = defel;
481+
}
474482
else if (strcmp(defel->defname, "set") == 0)
475483
{
476484
*set_items = lappend(*set_items, defel->arg);
@@ -564,6 +572,7 @@ compute_attributes_sql_style(List *options,
564572
char *volatility_p,
565573
bool *strict_p,
566574
bool *security_definer,
575+
bool *leakproof_p,
567576
ArrayType **proconfig,
568577
float4 *procost,
569578
float4 *prorows)
@@ -575,6 +584,7 @@ compute_attributes_sql_style(List *options,
575584
DefElem *volatility_item = NULL;
576585
DefElem *strict_item = NULL;
577586
DefElem *security_item = NULL;
587+
DefElem *leakproof_item = NULL;
578588
List *set_items = NIL;
579589
DefElem *cost_item = NULL;
580590
DefElem *rows_item = NULL;
@@ -611,6 +621,7 @@ compute_attributes_sql_style(List *options,
611621
&volatility_item,
612622
&strict_item,
613623
&security_item,
624+
&leakproof_item,
614625
&set_items,
615626
&cost_item,
616627
&rows_item))
@@ -653,6 +664,8 @@ compute_attributes_sql_style(List *options,
653664
*strict_p = intVal(strict_item->arg);
654665
if (security_item)
655666
*security_definer = intVal(security_item->arg);
667+
if (leakproof_item)
668+
*leakproof_p = intVal(leakproof_item->arg);
656669
if (set_items)
657670
*proconfig = update_proconfig_value(NULL, set_items);
658671
if (cost_item)
@@ -805,7 +818,8 @@ CreateFunction(CreateFunctionStmt *stmt, const char *queryString)
805818
Oid requiredResultType;
806819
bool isWindowFunc,
807820
isStrict,
808-
security;
821+
security,
822+
isLeakProof;
809823
char volatility;
810824
ArrayType *proconfig;
811825
float4 procost;
@@ -828,6 +842,7 @@ CreateFunction(CreateFunctionStmt *stmt, const char *queryString)
828842
isWindowFunc = false;
829843
isStrict = false;
830844
security = false;
845+
isLeakProof = false;
831846
volatility = PROVOLATILE_VOLATILE;
832847
proconfig = NULL;
833848
procost = -1; /* indicates not set */
@@ -837,7 +852,7 @@ CreateFunction(CreateFunctionStmt *stmt, const char *queryString)
837852
compute_attributes_sql_style(stmt->options,
838853
&as_clause, &language,
839854
&isWindowFunc, &volatility,
840-
&isStrict, &security,
855+
&isStrict, &security, &isLeakProof,
841856
&proconfig, &procost, &prorows);
842857

843858
/* Look up the language and validate permissions */
@@ -874,6 +889,16 @@ CreateFunction(CreateFunctionStmt *stmt, const char *queryString)
874889

875890
ReleaseSysCache(languageTuple);
876891

892+
/*
893+
* Only superuser is allowed to create leakproof functions because
894+
* it possibly allows unprivileged users to reference invisible tuples
895+
* to be filtered out using views for row-level security.
896+
*/
897+
if (isLeakProof && !superuser())
898+
ereport(ERROR,
899+
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
900+
errmsg("only superuser can define a leakproof function")));
901+
877902
/*
878903
* Convert remaining parameters of CREATE to form wanted by
879904
* ProcedureCreate.
@@ -960,6 +985,7 @@ CreateFunction(CreateFunctionStmt *stmt, const char *queryString)
960985
false, /* not an aggregate */
961986
isWindowFunc,
962987
security,
988+
isLeakProof,
963989
isStrict,
964990
volatility,
965991
parameterTypes,
@@ -1238,6 +1264,7 @@ AlterFunction(AlterFunctionStmt *stmt)
12381264
DefElem *volatility_item = NULL;
12391265
DefElem *strict_item = NULL;
12401266
DefElem *security_def_item = NULL;
1267+
DefElem *leakproof_item = NULL;
12411268
List *set_items = NIL;
12421269
DefElem *cost_item = NULL;
12431270
DefElem *rows_item = NULL;
@@ -1274,6 +1301,7 @@ AlterFunction(AlterFunctionStmt *stmt)
12741301
&volatility_item,
12751302
&strict_item,
12761303
&security_def_item,
1304+
&leakproof_item,
12771305
&set_items,
12781306
&cost_item,
12791307
&rows_item) == false)
@@ -1286,6 +1314,14 @@ AlterFunction(AlterFunctionStmt *stmt)
12861314
procForm->proisstrict = intVal(strict_item->arg);
12871315
if (security_def_item)
12881316
procForm->prosecdef = intVal(security_def_item->arg);
1317+
if (leakproof_item)
1318+
{
1319+
if (intVal(leakproof_item->arg) && !superuser())
1320+
ereport(ERROR,
1321+
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
1322+
errmsg("only superuser can define a leakproof function")));
1323+
procForm->proleakproof = intVal(leakproof_item->arg);
1324+
}
12891325
if (cost_item)
12901326
{
12911327
procForm->procost = defGetNumeric(cost_item);

‎src/backend/commands/proclang.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,7 @@ CreateProceduralLanguage(CreatePLangStmt *stmt)
131131
false, /* isAgg */
132132
false, /* isWindowFunc */
133133
false, /* security_definer */
134+
false, /* isLeakProof */
134135
false, /* isStrict */
135136
PROVOLATILE_VOLATILE,
136137
buildoidvector(funcargtypes, 0),
@@ -166,6 +167,7 @@ CreateProceduralLanguage(CreatePLangStmt *stmt)
166167
false, /* isAgg */
167168
false, /* isWindowFunc */
168169
false, /* security_definer */
170+
false, /* isLeakProof */
169171
true, /* isStrict */
170172
PROVOLATILE_VOLATILE,
171173
buildoidvector(funcargtypes, 1),
@@ -204,6 +206,7 @@ CreateProceduralLanguage(CreatePLangStmt *stmt)
204206
false, /* isAgg */
205207
false, /* isWindowFunc */
206208
false, /* security_definer */
209+
false, /* isLeakProof */
207210
true, /* isStrict */
208211
PROVOLATILE_VOLATILE,
209212
buildoidvector(funcargtypes, 1),

‎src/backend/commands/typecmds.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1521,6 +1521,7 @@ makeRangeConstructors(const char *name, Oid namespace,
15211521
false, /* isAgg */
15221522
false, /* isWindowFunc */
15231523
false, /* security_definer */
1524+
false, /* leakproof */
15241525
false, /* isStrict */
15251526
PROVOLATILE_IMMUTABLE, /* volatility */
15261527
constructorArgTypesVector, /* parameterTypes */

‎src/backend/optimizer/path/allpaths.c

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1042,16 +1042,9 @@ set_subquery_pathlist(PlannerInfo *root, RelOptInfo *rel,
10421042
RestrictInfo *rinfo = (RestrictInfo *) lfirst(l);
10431043
Node *clause = (Node *) rinfo->clause;
10441044

1045-
/*
1046-
* XXX. You might wonder why we're testing rte->security_barrier
1047-
* qual-by-qual here rather than hoisting the test up into the
1048-
* surrounding if statement; after all, the answer will be the
1049-
* same for all quals. The answer is that we expect to shortly
1050-
* change this logic to allow pushing down some quals that use only
1051-
* "leakproof" operators even through a security barrier.
1052-
*/
10531045
if (!rinfo->pseudoconstant &&
1054-
!rte->security_barrier &&
1046+
(!rte->security_barrier ||
1047+
!contain_leaky_functions(clause)) &&
10551048
qual_is_pushdown_safe(subquery, rti, clause, differentTypes))
10561049
{
10571050
/* Push it down */

0 commit comments

Comments
 (0)