pg_stat_monitor
pg_stat_monitor copied to clipboard
Non-generalised query items should not be visible to non-super user
This is a security threat that a non-super user can see the user data using pg_stat_monitor. For example
SELECT id, Name from cards where card_no like "1235-1253-3735-2674";
pg_stat_statments and pg_stat_monitor (Generalized mode) show this SELECT id, Name from cards where card_no like "?";
But in the non-generalized option, pg_stat_monitor will show the original data.
SELECT id, Name from cards where card_no like "1235-1253-3735-2674";
https://jira.percona.com/browse/PG-565