Repository navigation
fix(0003,0006,0015): lint user-authored RLS policies in storage and realtime - #202
Open
djedi-knight wants to merge 1 commit into
Open
djedi-knight wants to merge 1 commit into
djedi-knight wants to merge 1 commit into
Conversation
…ealtime Users write their own RLS policies on storage.objects and realtime.messages, but the policy-content lints excluded those schemas entirely, so slow or insecure policies there went unreported (supabase#35). Following the precedent of supabase#88 (0003 on realtime), drop the schemas from the exclusion lists of the lints that inspect policy content: - 0003 auth_rls_initplan: add storage (realtime already enabled) - 0006 multiple_permissive_policies: add storage - 0015 rls_references_user_metadata: add storage and realtime Lints about table configuration (0007, 0008, 0013) stay excluded, since users can't change RLS settings on Supabase-owned tables, and auth stays excluded everywhere. 0006 is not re-enabled on realtime: it only inspects relkind 'r', and realtime.messages is partitioned. Tests cover the new storage/realtime findings and that auth remains excluded. splinter.sql regenerated with bin/compile.py. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017TAbfjJfpipDmD7NJuQmPx
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix(0003,0006,0015): lint user-authored RLS policies in storage and realtime
Closes #35.
Problem
Users write their own RLS policies on
storage.objectsandrealtime.messages. The lints that inspect policy content excluded both schemas entirely, so slow or insecure policies there went unreported. For example,owner = auth.uid()onstorage.objectsis a very common policy, and it re-evaluates the function for every row.Change
This follows the precedent of #88, which re-enabled 0003 on
realtime. It removesstorageandrealtimefrom the exclusion list of the lints that judge policy content:Left unchanged on purpose:
authstays excluded everywhere, because users don't author policies there. The tests assert this.using (true)when the policy name claims owner or role scope #195 has that file open.0006 on realtime: 0006 only inspects
relkind = 'r', andrealtime.messagesis a partitioned table (relkind = 'p'). Removingrealtimefrom its exclusion list would pass a test but never fire in production. Covering partitioned tables in 0006 is a separate change that also affectspublic, so it isn't in this PR.Tests
storage.objects(and onrealtime.messagesfor 0015) and expect one finding. They also create the same policy on anauthtable and expect none.supabase/postgres:15.14.1.169. The finalsplinter.sqlvalidity step also passes.splinter.sqlwas regenerated withbin/compile.py. All pre-commit hooks pass.🤖 Generated with Claude Code
https://claude.ai/code/session_017TAbfjJfpipDmD7NJuQmPx