fix(0028,0029): only report functions exposed by PostgREST

lints/0028_anon_security_definer_function_executable.sql

@@ -60,6 +60,10 @@ from
                 on p.prolang = l.oid
         where
             p.prosecdef = true
+            -- PostgREST only exposes ordinary functions: procedures are not
+            -- callable via /rpc, and neither are trigger functions.
+            and p.prokind = 'f'
+            and p.prorettype <> 'pg_catalog.trigger'::regtype
             and pg_catalog.has_function_privilege('anon', p.oid, 'EXECUTE')
             and n.nspname = any(array(select trim(unnest(string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ',')))))
             and n.nspname not in (

lints/0029_authenticated_security_definer_function_executable.sql

@@ -61,6 +61,10 @@ from
                 on p.prolang = l.oid
         where
             p.prosecdef = true
+            -- PostgREST only exposes ordinary functions: procedures are not
+            -- callable via /rpc, and neither are trigger functions.
+            and p.prokind = 'f'
+            and p.prorettype <> 'pg_catalog.trigger'::regtype
             and pg_catalog.has_function_privilege('authenticated', p.oid, 'EXECUTE')
             and n.nspname = any(array(select trim(unnest(string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ',')))))
             and n.nspname not in (

splinter.sql

@@ -1756,6 +1756,10 @@ from
                 on p.prolang = l.oid
         where
             p.prosecdef = true
+            -- PostgREST only exposes ordinary functions: procedures are not
+            -- callable via /rpc, and neither are trigger functions.
+            and p.prokind = 'f'
+            and p.prorettype <> 'pg_catalog.trigger'::regtype
             and pg_catalog.has_function_privilege('anon', p.oid, 'EXECUTE')
             and n.nspname = any(array(select trim(unnest(string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ',')))))
             and n.nspname not in (
@@ -1829,6 +1833,10 @@ from
                 on p.prolang = l.oid
         where
             p.prosecdef = true
+            -- PostgREST only exposes ordinary functions: procedures are not
+            -- callable via /rpc, and neither are trigger functions.
+            and p.prokind = 'f'
+            and p.prorettype <> 'pg_catalog.trigger'::regtype
             and pg_catalog.has_function_privilege('authenticated', p.oid, 'EXECUTE')
             and n.nspname = any(array(select trim(unnest(string_to_array(coalesce(current_setting('pgrst.db_schemas', 't'), 'public'), ',')))))
             and n.nspname not in (

test/expected/0028_anon_security_definer_function_executable.out

@@ -121,4 +121,30 @@ begin;
 (0 rows)
 
   rollback to savepoint case_system_schema;
+  savepoint case_not_rpc_callable;
+  ----------------------------------------
+  -- NEGATIVE: procedures are not exposed by PostgREST, so a
+  -- SECURITY DEFINER procedure must not be reported as callable via
+  -- /rest/v1/rpc.
+  ----------------------------------------
+  create procedure public.secdef_proc() language sql security definer
+    as $$ select 1 $$;
+  select * from lint."0028_anon_security_definer_function_executable";
+ name | title | level | facing | categories | description | detail | remediation | metadata | cache_key 
+------+-------+-------+--------+------------+-------------+--------+-------------+----------+-----------
+(0 rows)
+
+  ----------------------------------------
+  -- NEGATIVE: trigger functions return trigger and are not exposed
+  -- as RPC endpoints either.
+  ----------------------------------------
+  create function public.secdef_trigger() returns trigger
+    language plpgsql security definer
+    as $$ begin return new; end $$;
+  select * from lint."0028_anon_security_definer_function_executable";
+ name | title | level | facing | categories | description | detail | remediation | metadata | cache_key 
+------+-------+-------+--------+------------+-------------+--------+-------------+----------+-----------
+(0 rows)
+
+  rollback to savepoint case_not_rpc_callable;
 rollback;

test/expected/0029_authenticated_security_definer_function_executable.out

@@ -117,4 +117,30 @@ begin;
 (0 rows)
 
   rollback to savepoint case_system_schema;
+  savepoint case_not_rpc_callable;
+  ----------------------------------------
+  -- NEGATIVE: procedures are not exposed by PostgREST, so a
+  -- SECURITY DEFINER procedure must not be reported as callable via
+  -- /rest/v1/rpc.
+  ----------------------------------------
+  create procedure public.secdef_proc() language sql security definer
+    as $$ select 1 $$;
+  select * from lint."0029_authenticated_security_definer_function_executable";
+ name | title | level | facing | categories | description | detail | remediation | metadata | cache_key 
+------+-------+-------+--------+------------+-------------+--------+-------------+----------+-----------
+(0 rows)
+
+  ----------------------------------------
+  -- NEGATIVE: trigger functions return trigger and are not exposed
+  -- as RPC endpoints either.
+  ----------------------------------------
+  create function public.secdef_trigger() returns trigger
+    language plpgsql security definer
+    as $$ begin return new; end $$;
+  select * from lint."0029_authenticated_security_definer_function_executable";
+ name | title | level | facing | categories | description | detail | remediation | metadata | cache_key 
+------+-------+-------+--------+------------+-------------+--------+-------------+----------+-----------
+(0 rows)
+
+  rollback to savepoint case_not_rpc_callable;
 rollback;

test/sql/0028_anon_security_definer_function_executable.sql

@@ -110,4 +110,26 @@ begin;
 
   rollback to savepoint case_system_schema;
 
+  savepoint case_not_rpc_callable;
+
+  ----------------------------------------
+  -- NEGATIVE: procedures are not exposed by PostgREST, so a
+  -- SECURITY DEFINER procedure must not be reported as callable via
+  -- /rest/v1/rpc.
+  ----------------------------------------
+  create procedure public.secdef_proc() language sql security definer
+    as $$ select 1 $$;
+  select * from lint."0028_anon_security_definer_function_executable";
+
+  ----------------------------------------
+  -- NEGATIVE: trigger functions return trigger and are not exposed
+  -- as RPC endpoints either.
+  ----------------------------------------
+  create function public.secdef_trigger() returns trigger
+    language plpgsql security definer
+    as $$ begin return new; end $$;
+  select * from lint."0028_anon_security_definer_function_executable";
+
+  rollback to savepoint case_not_rpc_callable;
+
 rollback;

test/sql/0029_authenticated_security_definer_function_executable.sql

@@ -105,4 +105,26 @@ begin;
 
   rollback to savepoint case_system_schema;
 
+  savepoint case_not_rpc_callable;
+
+  ----------------------------------------
+  -- NEGATIVE: procedures are not exposed by PostgREST, so a
+  -- SECURITY DEFINER procedure must not be reported as callable via
+  -- /rest/v1/rpc.
+  ----------------------------------------
+  create procedure public.secdef_proc() language sql security definer
+    as $$ select 1 $$;
+  select * from lint."0029_authenticated_security_definer_function_executable";
+
+  ----------------------------------------
+  -- NEGATIVE: trigger functions return trigger and are not exposed
+  -- as RPC endpoints either.
+  ----------------------------------------
+  create function public.secdef_trigger() returns trigger
+    language plpgsql security definer
+    as $$ begin return new; end $$;
+  select * from lint."0029_authenticated_security_definer_function_executable";
+
+  rollback to savepoint case_not_rpc_callable;
+
 rollback;