PulseAugur
中
实时 21:58:28
English(EN) A Supabase table with RLS enabled can still leak every row to every signed-in user. That happens when the policy is only "authenticated can select". Being logge

Supabase RLS 漏洞可能将所有行泄露给已登录用户

作者 PulseAugur 编辑部 · [2 个来源] ·

两条 Mastodon 帖子强调了 Supabase 中的一个安全漏洞，即启用行级别安全 (RLS) 的表仍然可以将所有行暴露给任何已登录用户。当 RLS 策略设置为“已认证用户可以查询”而没有额外的行所有权或租户 ID 检查时，就会发生这种情况。帖子建议在策略中实现所有者检查，例如 `auth.uid() = user_id`，以防止此类数据泄露，并建议通过尝试从辅助帐户访问数据来进行测试。 AI

影响 强调了一个流行的后端即服务平台中潜在的数据安全缺陷，与构建 AI 应用程序的开发人员相关。

排序理由 该集群讨论了数据库服务中的特定技术漏洞及其缓解措施，属于工具范畴。

在 Mastodon — mastodon.social 阅读 →

AI 生成摘要 · Google Gemini · 来自 2 个来源。 我们如何撰写摘要 →

Supabase RLS 漏洞可能将所有行泄露给已登录用户

本文如何被排名

Signal score
1 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
该集群讨论了数据库服务中的特定技术漏洞及其缓解措施，属于工具范畴。
Source corroboration
2 independent sources
Multiple independent publishers reporting the same story raises confidence that it's real and newsworthy.
Topics
product, safety
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
Same-day
Cluster formed today. Ranking reflects the current source set at time of score.

完整方法见我们的编辑标准。

报道来源 [2]

  1. Mastodon — mastodon.social TIER_1 English(EN) · abbilabs ·

    一个表可以显示启用了RLS但仍将每一行都交给每个已登录用户。当策略仅为“已认证用户可以选择”，没有所有者或

    A table can show RLS enabled and still hand every row to every signed-in user. That happens when the policy is only "authenticated can select", with no owner or tenant check. Login is not the same as owning the row. How to find tables like that, and the SQL to tighten them: https…

    链接 abbilabs.xyz/…/supabase-rls-check
  2. Mastodon — mastodon.social TIER_1 English(EN) · abbilabs ·

    启用了 RLS 的 Supabase 表仍可能将所有行泄露给每个已登录用户。当策略仅为“已认证用户可选择”时就会发生这种情况。登录后

    A Supabase table with RLS enabled can still leak every row to every signed-in user. That happens when the policy is only "authenticated can select". Being logged in is not the same as owning the row. Put the owner check in the policy (auth.uid() = user_id, or your tenant column).…

相关实体

相关话题