jmealo

Can we use PostrgreSQL's row-level-security to enable arbitrary query execution security in secure multi-tenant web applications?

Can we break out and access another tenants information?

No, this is handled using schemas, ownership and roles (users). Using RLS does not impact leaking data between tenants. This allows us to give out SQL accounts that can run arbitrary queries without leaking data between tenants.

How can we protect against role or privileges escalation within a tenant?

Consider an application that has 3 user types (roles):

zdk

#gem 'colorize'
module Version
  VERSION_FILE   = "#{Rails.root}/config/initializers/version.rb"
  PATTERN        = /(\d+)\.(\d+)\.(\d+)-(.*)/
  PATTERN_NOMETA = /(\d+\.\d+\.\d+)/

  @@major = 0; @@minor = 0; @@patch = 0; @@build = 'a'
  @@version_rb = File.read(VERSION_FILE)

  def self.version_rb