Zum Hauptinhalt springen
IT Security NachrichtenHardcoded MCP credentials found in public GitHub files(18.09.2026 um 07:30 Uhr)
IT Security NachrichtenAbandoned IoT apps keep sending sensitive data to broken servers(18.09.2026 um 08:00 Uhr)
IT Security NachrichtenNeue Cyberattacken: FamousSparrow nimmt Lateinamerika ins Visier(17.09.2026 um 11:00 Uhr)
Linux Tipps & HardeningAusführen beliebiger Kommandos in GitPython (Fedora)(18.09.2026 um 07:45 Uhr)
Linux Tipps & HardeningMehrere Probleme in freeipmi (Fedora)(18.09.2026 um 07:45 Uhr)
Linux Tipps & HardeningZwei Probleme in parted (Fedora)(18.09.2026 um 07:48 Uhr)
Linux Tipps & HardeningZwei Probleme in gnatcoll (Fedora)(18.09.2026 um 07:48 Uhr)
Linux Tipps & HardeningDenial of Service in nodejs-undici (Fedora)(18.09.2026 um 07:48 Uhr)
Linux Tipps & HardeningUnsichere Verwendung temporärer Dateien in sblim-cmpi-base (Fedora)(18.09.2026 um 07:48 Uhr)
IT Security NachrichtenHardcoded MCP credentials found in public GitHub files(18.09.2026 um 07:30 Uhr)
IT Security NachrichtenAbandoned IoT apps keep sending sensitive data to broken servers(18.09.2026 um 08:00 Uhr)
IT Security NachrichtenNeue Cyberattacken: FamousSparrow nimmt Lateinamerika ins Visier(17.09.2026 um 11:00 Uhr)
Linux Tipps & HardeningAusführen beliebiger Kommandos in GitPython (Fedora)(18.09.2026 um 07:45 Uhr)
Linux Tipps & HardeningMehrere Probleme in freeipmi (Fedora)(18.09.2026 um 07:45 Uhr)
Linux Tipps & HardeningZwei Probleme in parted (Fedora)(18.09.2026 um 07:48 Uhr)
Linux Tipps & HardeningZwei Probleme in gnatcoll (Fedora)(18.09.2026 um 07:48 Uhr)
Linux Tipps & HardeningDenial of Service in nodejs-undici (Fedora)(18.09.2026 um 07:48 Uhr)
Linux Tipps & HardeningUnsichere Verwendung temporärer Dateien in sblim-cmpi-base (Fedora)(18.09.2026 um 07:48 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

The auth_rls_initplan linter has a blind spot: SECURITY DEFINER bodies

If you've ever migrated a Supabase project to the wrapped (SELECT auth.uid()) pattern, you know the linter that flags the bare call. auth_rls_initplan reads every RLS policy expression and warns whenever auth.uid() is used directly instead of inside a scalar subselect. The wrap turns the call from a per-row evaluation into a single InitPlan. On a million-row table that is the difference between a 30ms read and a 30-second read.

The linter is good. It is also incomplete.

What it doesn't see

The linter introspects the policy expression itself. It does not walk into the body of any function the policy calls. So this passes the linter cleanly:

CREATE OR REPLACE FUNCTION public.is_owner(target_user uuid)
    RETURNS boolean
    LANGUAGE sql
    SECURITY DEFINER
    STABLE
AS $$
    SELECT auth.uid() = target_user;
$$;

CREATE POLICY rows_owner ON public.things
    FOR SELECT
    USING ((SELECT public.is_owner(user_id)));

Green linter. Slow query. The (SELECT ...) at the policy level caches the return value of is_owner(user_id), which itself depends on the row's user_id and runs every row. The auth call inside the function is back to per-row evaluation, and the InitPlan optimization the wrap was supposed to enable never kicks in.

The fix is the same wrap, one level deeper

Move the scalar subselect inside the function body:

CREATE OR REPLACE FUNCTION public.is_owner(target_user uuid)
    RETURNS boolean
    LANGUAGE sql
    SECURITY DEFINER
    STABLE
AS $$
    SELECT (SELECT auth.uid()) = target_user;
$$;

The function still runs per row, but the auth lookup inside it is the single InitPlan call the optimization was designed for.

How to find them

Grep the schema for auth.uid() inside function bodies, not just policies:

pg_dump --schema-only your_db \
    | rg -B 5 'auth\.(uid|jwt)\(\)' \
    | rg -A 2 'SECURITY DEFINER'

Or EXPLAIN ANALYZE the slow query and look for a subplan that fires once per row instead of once per query. If it scales with rows scanned, you have one of these.

The linter is a good first pass. This is the second pass to run before you call your migration done.

Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten The auth_rls_initplan linter has a blind spot: SECURITY DEFINER bodies

Thematisch verwandte Begriffe: authrlsinitplan, linter, blind, spot · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-61591 | djust provides Phoenix LiveView-style reactive server-side rendering for…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
News ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

↗ Original-Quelle