undefined | Better HN

0 pointsrefulgentis2y ago0 comments

The "when I create a table via SQL statements at shell it does what I say" isn't a vulnerability, I don't think.

The comment chain went long enough that I got confused and thought I was missing something, I started a brand new account, brand new project, brand new table, RLS is enabled by default, has a big recommended next to it highlighted, it is checked, the entire section is highlighted, and has documentation right below it. Source: https://imgur.com/a/X9oJ2i9

It's enabled by default, quite forcefully so

but I'm not a Postgres admin, maybe there's a stronger way you know of to enforce it, so you can prevent the footgun of CREATE TABLE?

0 comments

1 comments · 1 top-level

n2d42y ago

I mean, I don't disagree, but what I'm saying is that SQL/Postgres (hence also Supabase) was not designed for databases accessed from untrusted clients, instead, it's an afterthought and it shows.

Whether it's a "vulnerability" or by design is another question, but it's definitely a footgun (particularly for new Supabase users that use an ORM like Prisma, which has its own UI and creates tables by itself).

The solution might just be to not let untrusted clients access your DB.

j / k navigate · click thread line to collapse