Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions lints/0011_function_search_path_mutable.sql
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,10 @@ where
'_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'
)
and dep.objid is null -- exclude functions owned by extensions
-- Exclude aggregates: their pg_proc entry is a placeholder with no body and
-- CREATE AGGREGATE has no SET clause, so they can never carry a search_path.
-- The support functions they are built from are linted in their own right.
and p.prokind <> 'a'
-- Search path not set
and not exists (
select 1
Expand Down
4 changes: 4 additions & 0 deletions splinter.sql
Original file line number Diff line number Diff line change
Expand Up @@ -696,6 +696,10 @@ where
'_timescaledb_cache', '_timescaledb_catalog', '_timescaledb_config', '_timescaledb_internal', 'auth', 'cron', 'extensions', 'graphql', 'graphql_public', 'information_schema', 'net', 'pgmq', 'pgroonga', 'pgsodium', 'pgsodium_masks', 'pgtle', 'pgbouncer', 'pg_catalog', 'realtime', 'repack', 'storage', 'supabase_functions', 'supabase_migrations', 'tiger', 'topology', 'vault'
)
and dep.objid is null -- exclude functions owned by extensions
-- Exclude aggregates: their pg_proc entry is a placeholder with no body and
-- CREATE AGGREGATE has no SET clause, so they can never carry a search_path.
-- The support functions they are built from are linted in their own right.
and p.prokind <> 'a'
-- Search path not set
and not exists (
select 1
Expand Down
37 changes: 37 additions & 0 deletions test/expected/0011_function_search_path_mutable.out
Original file line number Diff line number Diff line change
Expand Up @@ -47,4 +47,41 @@ begin;
------+-------+-------+--------+------------+-------------+--------+-------------+----------+-----------
(0 rows)

-- An aggregate is not reported: CREATE AGGREGATE has no SET clause, so its
-- pg_proc entry can never carry a search_path
create function public.uuid_min(uuid, uuid)
returns uuid
set search_path = ''
language sql
immutable strict
as $$
select least($1, $2);
$$;
create aggregate public.min_uuid(uuid) (
sfunc = public.uuid_min,
stype = uuid,
combinefunc = public.uuid_min,
parallel = safe
);
-- 0 issues
select * from lint."0011_function_search_path_mutable";
name | title | level | facing | categories | description | detail | remediation | metadata | cache_key
------+-------+-------+--------+------------+-------------+--------+-------------+----------+-----------
(0 rows)

-- The support function is still linted on its own
create or replace function public.uuid_min(uuid, uuid)
returns uuid
language sql
immutable strict
as $$
select least($1, $2);
$$;
-- 1 issue, for public.uuid_min and not for the aggregate
select * from lint."0011_function_search_path_mutable";
name | title | level | facing | categories | description | detail | remediation | metadata | cache_key
------------------------------+------------------------------+-------+----------+------------+---------------------------------------------------------------+-------------------------------------------------------------+--------------------------------------------------------------------------------------------------+--------------------------------------------------------------+-------------------------------------------------------------------------------
function_search_path_mutable | Function Search Path Mutable | WARN | EXTERNAL | {SECURITY} | Detects functions where the search_path parameter is not set. | Function \`public.uuid_min\` has a role mutable search_path | https://supabase.com/docs/guides/database/database-linter?lint=0011_function_search_path_mutable | {"name": "uuid_min", "type": "function", "schema": "public"} | function_search_path_mutable_public_uuid_min_f4e24529160b926c46151c3f612a6c29
(1 row)

rollback;
33 changes: 33 additions & 0 deletions test/sql/0011_function_search_path_mutable.sql
Original file line number Diff line number Diff line change
Expand Up @@ -39,5 +39,38 @@ begin;
select * from lint."0011_function_search_path_mutable";


-- An aggregate is not reported: CREATE AGGREGATE has no SET clause, so its
-- pg_proc entry can never carry a search_path
create function public.uuid_min(uuid, uuid)
returns uuid
set search_path = ''
language sql
immutable strict
as $$
select least($1, $2);
$$;

create aggregate public.min_uuid(uuid) (
sfunc = public.uuid_min,
stype = uuid,
combinefunc = public.uuid_min,
parallel = safe
);

-- 0 issues
select * from lint."0011_function_search_path_mutable";

-- The support function is still linted on its own
create or replace function public.uuid_min(uuid, uuid)
returns uuid
language sql
immutable strict
as $$
select least($1, $2);
$$;

-- 1 issue, for public.uuid_min and not for the aggregate
select * from lint."0011_function_search_path_mutable";


rollback;