Ensure that AFTER triggers run as the instigating user. With deferred triggers, it is possible that the current role changes between the time when the trigger is queued and the time it is executed (for example, the triggering data modification could have been executed in a SECURITY DEFINER function).
Up to now, deferred trigger functions would run with the current role set to whatever was active at commit time. That does not matter for foreign-key constraints, whose correctness doesn't depend on the current role. But for user-written triggers, the current role certainly can matter. Hence, fix things so that AFTER triggers are fired under the role that was active when they were queued, matching the behavior of BEFORE triggers which would have actually fired at that time. (If the trigger function is marked SECURITY DEFINER, that of course overrides this, as it always has.) This does not create any new security exposure: if you do DML on a table owned by a hostile user, that user has always had various ways to exploit your permissions, such as the aforementioned BEFORE triggers, default expressions, etc. It might remove some security exposure, because the old behavior could potentially expose some other role besides the one directly modifying the table. There was discussion of making a larger change, such as running as the trigger's owner. However, that would break the common idiom of capturing the value of CURRENT_USER in a trigger for auditing/logging purposes. This change will make no difference in the typical scenario where the current role doesn't change before commit. Arguably this is a bug fix, but it seems too big a semantic change to consider for back-patching. Author: Laurenz Albe <laurenz.a...@cybertec.at> Reviewed-by: Joseph Koshakow <kosh...@gmail.com> Reviewed-by: Pavel Stehule <pavel.steh...@gmail.com> Discussion: https://postgr.es/m/77ee784cf248e842f74588418f55c2931e47bd78.ca...@cybertec.at Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/01463e1cccd33fb11b33a4dd6dbebcad3c534102 Modified Files -------------- doc/src/sgml/trigger.sgml | 4 ++ src/backend/commands/trigger.c | 20 ++++++++++ src/test/regress/expected/triggers.out | 67 ++++++++++++++++++++++++++++++++++ src/test/regress/sql/triggers.sql | 63 ++++++++++++++++++++++++++++++++ 4 files changed, 154 insertions(+)
