Should `search_path` be set due to use of `SECURITY DEFINER` about supa_audit

[olirice]

interesting stuff

From that same doc:

This prevents malicious users from creating objects that mask objects used by the function

so the risk is that the user could manipulate a schema they control, that is on the search path, to obscure the table that we want to audit

Something like

create schema malicious;
create schema public;

create table public.account ....;

-- malicious user wants to hide 'public.account'
create table malicious.account ...;

-- if our search path looked like this
set search_path = 'malicious,public';

-- and the admin didn't specify the schema when auditing a table
select audit.enable_tracking('account'::regclass);

then the admin might think they're auditing public.account when they're actually auditing malicious.account.

It seems like a low risk but I'll leave this open and add an explicit search_path next time we do an update

thanks for raising the question