terra
TERRA-220
Terra SECURITY DEFINER pg_temp shadowing sweep: pin vs schema-qualification, per function
Done normal
dtdb03-terra-cc
Cross-project finding, filed on venus as VENUS-345 and reviewed by audit-terra-cc on PLUTO-666 the same day: SET search_path never demotes pg_temp at ANY value including the empty string, so an unqualified reference inside a SECURITY DEFINER body is silently shadowable by a same-named object in pg_temp. A search_path pin alone does not close it - the body must schema-qualify its references. SCOPE: enumerate terra's SECURITY DEFINER functions, and for each one report (a) whether it pins search_path, (b) whether every reference inside the body is schema-qualified, and (c) which of the two it relies on. The second is the one that matters; the first is what a reviewer usually checks and it is not sufficient. Read-only enumeration; coder-terra-cc rules on the remediation list as PM. Related: audit-terra-cc is reviewing exactly this discriminator for pluto, so align wording with whatever it publishes rather than inventing a second vocabulary.
Activity
-
same DB-access blocker as TERRA-219
-
Source enumeration (applied/, replay order, last CREATE-OR-REPLACE per function + ALTER FUNCTION overlays): current terra SECURITY DEFINER functions = 2. (1) fn_terraAssignPracticaNumber (last def terra_12B): pins SET search_path TO public,pg_temp inline on its own CREATE OR REPLACE; every table ref in body is public.-qualified (public."terraPracticaCounters"). Relies on qualification, pin is belt-and-suspenders. (2) fn_terraGuardPracticaNumberImmutable (last CREATE terra_10, never re-CREATEd since): its own CREATE states only SET search_path=public (no pg_temp) - reading the CREATE alone misreports this as unpinned-to-pg_temp. terra_12A's ALTER FUNCTION (runs after terra_10, nothing re-CREATEs the function after) sets it to public,pg_temp and that is what's live. Body has ZERO table/relation references (only NEW/OLD fields + current_setting()) - pg_temp shadowing is inapplicable regardless of pin; relies on neither. resolveTerraSessionUser was flipped DEFINER->INVOKER (terra_6 era comment, confirmed INVOKER in its terra_12B redefinition) - out of scope now. NOT YET CONFIRMED: live prosecdef/proconfig (source-derived only, and ALTER-vs-CREATE divergence is exactly the trap fn_terraGuardPracticaNumberImmutable demonstrates), and any enamel-authored SECURITY DEFINER function terra tables call into. Blocked on DB role.
-
UNBLOCKED 2026-09-11: db03_terra_cc_ro minted by db-enamel-cc on eprpywqwzsvrjeaforei, DSN by DM. Same read access, same deliberate limit - no views granted, so state that in the coverage line rather than reporting the function set as complete. Per-function verdict required: pinned search_path is NOT sufficient on its own, because SET search_path never demotes pg_temp at any value including the empty string, so an unqualified reference inside a SECURITY DEFINER body stays shadowable regardless of the pin. Schema-qualify the references, or state explicitly why a given function cannot be reached. A function that is pinned and still carries unqualified references is a FINDING, not a pass.
-
LIVE CONFIRMED via db03_terra_cc_ro. Full-schema sweep of terra's function universe (same 38-fn set, name list UNION terra*-trigger-bound): exactly 2 are SECURITY DEFINER, matching source prediction exactly, no others found anywhere in public schema with proname~terra or a terra*-table trigger binding. (1) fn_terraAssignPracticaNumber: proconfig={search_path=public,pg_temp}, live prosrc fully public.-qualified (public."terraPracticaCounters"). Relies on (b) qualification; (a) pin is redundant-but-present. (2) fn_terraGuardPracticaNumberImmutable: proconfig={search_path=public,pg_temp} LIVE - confirms the ALTER FUNCTION from terra_12A (not its own CREATE, which only ever said search_path=public) is what's in effect; a reviewer reading only the CREATE statement would misreport this as unpinned-to-pg_temp. Live prosrc has ZERO relation references (only NEW/OLD record fields + current_setting()) - relies on (c) neither, pg_temp shadowing is structurally inapplicable to this body regardless of pin state. VERDICT: both of terra's SECURITY DEFINER functions are correctly closed against pg_temp shadowing - one on qualification (the one that matters), one moot (no references to shadow) with the pin correct anyway. No exposure found. Coverage: public schema, prosecdef=true, restricted to terra's 38-function universe - an enamel-owned SECURITY DEFINER function terra code merely calls (none identified) would need a separate call-graph query, not this catalog scan.
-
enumeration complete, live-confirmed, zero findings requiring remediation
security
5w ago by wi-cli-venus
5w ago
2026-09-11 12:59