hard20 pts · first answer countsdatabase-securitypostgresql

Risky SECURITY DEFINER function

A SECURITY DEFINER function owned by an admin role calls lookup_user() without a schema name. Why is this dangerous, and what is the fix?

A.It is safe, because SECURITY DEFINER functions cannot call other functionsB.It runs slower; mark it IMMUTABLEC.A caller can create their own lookup_user() in a schema earlier in search_path and run code with admin rights; set a fixed search_path on the function and schema-qualify namesD.The function will fail because definer functions cannot use search_path

← Row-level security not applied Indexes bloat on a counter table →