From cd30728fb2ed7c367d545fc14ab850b5fa2a4850 Mon Sep 17 00:00:00 2001 From: Robert Haas Date: Mon, 13 Feb 2012 22:20:27 -0500 Subject: Allow LEAKPROOF functions for better performance of security views. We don't normally allow quals to be pushed down into a view created with the security_barrier option, but functions without side effects are an exception: they're OK. This allows much better performance in common cases, such as when using an equality operator (that might even be indexable). There is an outstanding issue here with the CREATE FUNCTION / ALTER FUNCTION syntax: there's no way to use ALTER FUNCTION to unset the leakproof flag. But I'm committing this as-is so that it doesn't have to be rebased again; we can fix up the grammar in a future commit. KaiGai Kohei, with some wordsmithing by me. --- doc/src/sgml/catalogs.sgml | 12 ++++++++++++ doc/src/sgml/ref/alter_function.sgml | 13 ++++++++++++- doc/src/sgml/ref/create_function.sgml | 19 ++++++++++++++++++- doc/src/sgml/rules.sgml | 14 ++++++++++++++ 4 files changed, 56 insertions(+), 2 deletions(-) (limited to 'doc/src') diff --git a/doc/src/sgml/catalogs.sgml b/doc/src/sgml/catalogs.sgml index ea98cb72aa1..180554b8e39 100644 --- a/doc/src/sgml/catalogs.sgml +++ b/doc/src/sgml/catalogs.sgml @@ -4423,6 +4423,18 @@ function) + + proleakproof + bool + + + The function has no side effects. No information about the + arguments is conveyed except via the return value. Any function + that might throw an error depending on the values of its arguments + is not leakproof. + + + proisstrict bool diff --git a/doc/src/sgml/ref/alter_function.sgml b/doc/src/sgml/ref/alter_function.sgml index acb3e4fb93f..3ceb6123f4f 100644 --- a/doc/src/sgml/ref/alter_function.sgml +++ b/doc/src/sgml/ref/alter_function.sgml @@ -33,7 +33,7 @@ ALTER FUNCTION name ( [ [ action is one of: CALLED ON NULL INPUT | RETURNS NULL ON NULL INPUT | STRICT - IMMUTABLE | STABLE | VOLATILE + IMMUTABLE | STABLE | VOLATILE | LEAKPROOF [ EXTERNAL ] SECURITY INVOKER | [ EXTERNAL ] SECURITY DEFINER COST execution_cost ROWS result_rows @@ -191,6 +191,17 @@ ALTER FUNCTION name ( [ [ for more information about + this capability. + + + + COST execution_cost diff --git a/doc/src/sgml/ref/create_function.sgml b/doc/src/sgml/ref/create_function.sgml index 2a87130356e..7df66ab0e08 100644 --- a/doc/src/sgml/ref/create_function.sgml +++ b/doc/src/sgml/ref/create_function.sgml @@ -26,7 +26,7 @@ CREATE [ OR REPLACE ] FUNCTION | RETURNS TABLE ( column_name column_type [, ...] ) ] { LANGUAGE lang_name | WINDOW - | IMMUTABLE | STABLE | VOLATILE + | IMMUTABLE | STABLE | VOLATILE | LEAKPROOF | CALLED ON NULL INPUT | RETURNS NULL ON NULL INPUT | STRICT | [ EXTERNAL ] SECURITY INVOKER | [ EXTERNAL ] SECURITY DEFINER | COST execution_cost @@ -324,6 +324,23 @@ CREATE [ OR REPLACE ] FUNCTION + + LEAKPROOF + + + LEAKPROOF indicates that the function has no side + effects. It reveals no information about its arguments other than by + its return value. For example, a function which throws an error message + for some argument values but not others, or which includes the argument + values in any error message, is not leakproof. The query planner may + push leakproof functions (but not others) into views created with the + security_barrier option. See + and . + This option can only be set by the superuser. + + + + CALLED ON NULL INPUT RETURNS NULL ON NULL INPUT diff --git a/doc/src/sgml/rules.sgml b/doc/src/sgml/rules.sgml index 3038fe9adc0..59a32a8e18b 100644 --- a/doc/src/sgml/rules.sgml +++ b/doc/src/sgml/rules.sgml @@ -1890,6 +1890,20 @@ CREATE VIEW phone_number WITH (security_barrier) AS enabled by default. + + The query planner has more flexibility when dealing with functions that + have no side effects. Such functions are referred to as LEAKPROOF, and + include many simple, commonly used operators, such as many equality + operators. The query planner can safely allow such functions to be evaluated + at any point in the query execution process, since invoking them on rows + invisible to the user will not leak any information about the unseen rows. + In contrast, a function that might throw an error depending on the values + received as arguments (such as one that throws an error in the event of + overflow or division by zero) are not leak-proof, and could provide + significant information about the unseen rows if applied before the security + view's row filters. + + It is important to understand that even a view created with the security_barrier option is intended to be secure only -- cgit v1.2.3