CartoDB/CartoDB-SQL-API

Table soft validation is incorrect

Closed this issue · 1 comments

The current soft validation method is defined to block any table that starts with pg_:

softValidation(tables) {
for (let table of tables) {
if (table.table_name.match(/\bpg_/)) {
return false;
}
}
return true;

So if a user has a table called pg_sth it will be blocked too. A more effective way to block access to the pg_catalog schema is to check the table schema instead (and avoid using regex).

Closing stale ticket