On Mon, Sep 26, 2022 at 11:18:34AM -0700, Bryn Llewellyn wrote: > > My demo seems to show that when a program connects as "client", it can > perform exactly and only the database operations that the database design > specified. > > Am I missing something? In other words, can anybody show me a vulnerability? What exactly prevents the client role from inserting e.g. - 'robert''); drop table students; --' - millions of 'cat' rows - millions of 1GB-large rows or just keep sending massive invalid query texts to fill the logs, or just trying to connect until there's no available connection slots anymore, and then keep spamming the server thousands of time per second to try to open new connections, or ...?
