9 lines
671 B
SQL
9 lines
671 B
SQL
-- Block PostgreSQL system catalog tables from the public CRUD API.
|
|
-- The pg_ prefix covers pg_tables, pg_class, pg_user, pg_shadow, pg_authid, etc.
|
|
-- information_schema columns contain dots so they're already rejected by the
|
|
-- identifier validator, but we block them here for defense in depth.
|
|
INSERT INTO blacklist (pattern, method, reason, active) VALUES
|
|
('/api/pg_*', NULL, 'postgresql system catalog', true),
|
|
('/api/pg_*/**', NULL, 'postgresql system catalog', true),
|
|
('/api/information_schema', NULL, 'postgresql information schema', true),
|
|
('/api/information_schema/**', NULL, 'postgresql information schema', true);
|