postgresql/no-security-definer-without-search-path

Why this matters

A `SECURITY DEFINER` function runs with the owner's privileges. If the caller controls `search_path`, they can shadow built-ins (e.g. `pg_catalog.lower`) with their own functions and execute code as the owner — a recurring CVE pattern. Pin `search_path` (e.g. `SET search_path = pg_catalog, pg_temp`) on every `SECURITY DEFINER` function. `SECURITY INVOKER` (the default) is out of scope.

Examples

CREATE FUNCTION fn() RETURNS void
LANGUAGE plpgsql
SECURITY DEFINER
AS $$ BEGIN END $$;

CREATE FUNCTION fn() RETURNS void
LANGUAGE plpgsql
SECURITY DEFINER
SET search_path = pg_catalog, pg_temp
AS $$ BEGIN END $$;

Configure it

// eslint.config.js
import postgresql from "eslint-plugin-postgresql";

export default [
  {
    files: ["**/*.sql"],
    languageOptions: {
      parser: postgresql.configs.recommended.languageOptions.parser,
    },
    plugins: { postgresql },
    rules: {
      "postgresql/no-security-definer-without-search-path": "error",
    },
  },
];

Options

This rule has no options.