Search code, repositories, users, issues, pull requests...

pgspot checks extension scripts for following PostgreSQL security best practices. In addition to checking extension scripts it can also be used to check security definer functions or any other PostgreSQL SQL code.

Consult the reference for detailed documentation of the vulnerabilities which pgspot detects, and their potential mitigations.

It is a common pattern that SQL-accepting functions exist, which take a string-like argument which will be executed as SQL. This can "hide" some SQL from pgspot, as the string-like argument masks the SQL. With the --sql-accepting argument, pgspot can be told about such functions.

Assuming a function named execute_sql which takes a SQL string as its first argument, and executes it. With pgspot --sql-accepting=execute_sql we can tell pgspot execute_sql may accept SQL. pgspot will attempt to unpack and evaluate all arguments to that function as SQL.

Leave a Comment