supabase_auth_admin can CREATE roles
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
Research direction
Start with the role-attributes query and its expected output in nix/tests/expected/auth.out, focusing on the supabase_auth_admin rolcreaterole value. Trace the role setup that produces this result, then verify the auth test output shows role creation is no longer permitted while the other attributes remain unchanged.
Written by the indexing model from the issue text.
Description
Problem
The manager of the auth schema, supabase_auth_admin can create new roles on the database.
-- See https://github.com/supabase/postgres/blob/develop/nix/tests/expected/auth.out#L31
-- attributes of the supabase_auth_admin
select
rolcreaterole ,
rolcanlogin ,
rolsuper ,
rolinherit ,
rolcreatedb ,
rolreplication ,
rolconnlimit ,
rolbypassrls ,
rolvaliduntil
from pg_roles r
where r.rolname = 'supabase_auth_admin';
rolcreaterole | rolcanlogin | rolsuper | rolinherit | rolcreatedb | rolreplication | rolconnlimit | rolbypassrls | rolvaliduntil
---------------+-------------+----------+------------+-------------+----------------+--------------+--------------+---------------
t | t | f | f | f | f | -1 | f |
(1 row)
This is likely unneeded, and following the principle of least privilege, supabase_auth_admin shouldn't be able to.
Solution
Remove this privilege for suapbase_auth_admin.
- Dominant language
- Nix
- Stars
- 1.8k
- Forks
- 266
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 25
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from supabase/postgres
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
`supabase/postgres:17.6.1.105` (amd64) — backend SIGSEGV during a heavy pgTAP file, CI-CPU-specific Open
Difficulty 5/5 Over a week Newbie friendliness 30/100
-
Difficulty 4/5 3-5 days Newbie friendliness 52/100
All issues in supabase/postgres
Similar issues
-
bug: AI Gateway client filter lists "Unknown" twice when NULL and literal Unknown clients coexist Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
-
[BUG] A column whose default is the empty string is drawn in the ER diagram as having no default Openbug database-provider good first issue hacktoberfest
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
libredb/libredb-studio#1030 · 6 comments ·
-
comp-datalake
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
ClickHouse/ClickHouse#121222 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
bug redshift
Difficulty 2/5 1-3 hours Newbie friendliness 88/100