TablePlus-Windows icon indicating copy to clipboard operation
TablePlus-Windows copied to clipboard

Safe Mode 2 and Alert Mode 2 should still alert when using SELECT to invoke stored procedures

Open chipilov opened this issue 3 years ago • 0 comments

Please answer the questions below, it helps us to track the issue.

  1. Which driver are you using and version of it (Ex: PostgreSQL 10.0): PostgreSQL 14.1

  2. Which TablePlus build number are you using (the number on the welcome screen, Ex: build 81): Version 4.9.0, build 190

  3. The steps to reproduce this issue:

    1. Set Safe mode level to Safe Mode 2, i.e. 'Prompt for password before sending queries to the server except SELECT/EXPLAIN/SHOW queries'

    2. Call a stored procedure which modifies the data in the database with SELECT query, e.g. '''SELECT my_data_modifying_sproc()'''

    ACTUAL: The stored procedure is invoked and the data in the db is modified WITHOUT any password prompt

    EXPECTED: Even though technically the Safe Mode 2 constraints are satisfied (i.e. a SELECT query is executed which does NOT require password prompt), I assume that the motivation behind Safe Mode 2 (and Alert Mode 2) is to avoid modifying the DB without a password prompt. However, in the case of stored procedures this can still be done with a SELECT statement.

My suggestion is to either require a password prompt when invoking ANY stored procedure OR introduce a new level which ignores requires a password prompt for all stored procedures even if they are invoked with a select.

chipilov avatar May 12 '22 19:05 chipilov