Skip to content

Instantly share code, notes, and snippets.

View jmealo's full-sized avatar

Jeff Mealo jmealo

43 followers · 158 following
View GitHub Profile
@jmealo
jmealo / rls-security-multi-tennant.md
Last active June 20, 2019 17:34
How to safely allow arbitrary SQL queries in multi-tenant web applications

Can we use PostrgreSQL's row-level-security to enable arbitrary query execution security in secure multi-tenant web applications?

Can we break out and access another tenants information?

No, this is handled using schemas, ownership and roles (users). Using RLS does not impact leaking data between tenants. This allows us to give out SQL accounts that can run arbitrary queries without leaking data between tenants.

How can we protect against role or privileges escalation within a tenant?

Consider an application that has 3 user types (roles):

@jmealo
jmealo / refresh-materialized-views.sql
Created December 7, 2015 15:55
CREATE OR REPLACE FUNCTION refresh_materialized_views() RETURNS VOID
AS
$body$
DECLARE
result integer;
BEGIN
EXECUTE (SELECT string_agg('REFRESH MATERIALIZED VIEW ' || oid::regclass::text, ';')
FROM pg_class
WHERE relkind = 'm');
RETURN;
@jmealo
jmealo / output.json
Last active September 30, 2015 15:07
Illuminate API Documentation Scraper
{
"endPoints": {
"Sites": {
"description": "Returns a list of District and School sites.",
"method": "GET",
"urls": [
"https://<subdomain>.illuminateed.com/<root_dir>/rest_server.php/Api/Sites/"
],
"responseExample": [
{
@jmealo
jmealo / install_ispell_en_us.sh
Created August 6, 2015 14:33
#!/bin/bash
cd /usr/share/postgresql/9.4/tsearch_data
wget https://stop-words.googlecode.com/files/stop-words-collection-2011.11.21.zip
unzip stop-words-collection-2011.11.21.zip
wget http://src.chromium.org/svn/trunk/deps/third_party/hunspell_dictionaries/en_US.dic
wget http://src.chromium.org/svn/trunk/deps/third_party/hunspell_dictionaries/en_US.dic_delta
wget http://src.chromium.org/svn/trunk/deps/third_party/hunspell_dictionaries/en_US.aff -O en_us.affix
# Remove first line
@jmealo
jmealo / .gitconfig
Last active August 29, 2015 14:25
[user]
name = Jeffrey Mealo
email = jeffreymealo@gmail.com
[credential]
helper = osxkeychain
[core]
autocrlf = input
excludesfile = /Users/jmealo/.gitignore_global
@jmealo
jmealo / jsonpp
Created May 25, 2015 23:01
JSON prettifier for the terminal, just pipe to stdin and it'll output formatted JSON
#!/usr/bin/env node
var stdin = process.openStdin();
var data = "";
stdin.on('data', function(chunk) {
data += chunk;
});
@jmealo
jmealo / gist:f84d69cfc7d0c0e8489a
Created May 12, 2015 13:16
snippet to fix watcher for PHPStorm EAP 141.1000
// Insert this just after: if (/move/i.test(verb)) { @ line 115
if (file.indexOf('___jb_bak___') !== -1) {
verb = 'PUT';
destination = destination.replace('___jb_bak___', '');
file = destination;
fileStream = fs.createReadStream(file);
headers['Content-Length'] = fs.statSync(file).size;
}
/* Add the following entries to your config.json global ignore:
@jmealo
jmealo / gist:37e3234a6a55d266b960
Created January 9, 2015 19:02
dialpad code
<html>
<head>
<title>Softphone</title>
<script src="https://code.jquery.com/jquery-2.1.3.min.js"></script>
<script>
$(function() {
var $dialpad = $('#dialpad');
$(document).on('click', '#dialpad,[title="Dialpad"]', function(e) {
e.stopPropagation();
@jmealo
jmealo / gist:b94f34b037d53bffb31b
Last active August 29, 2015 14:00

Errors

All error messages should answer:

  • What went wrong.
  • What to do next.

Errors requiring escalation need:

  • Error logging that provides engineering, support and development pertinent information.
@jmealo
jmealo / spread.xml
Last active December 21, 2015 07:18
Spread SMF manifest for the pkgsrc distribution on SmartOS (based off: evercity's manifest)
<?xml version='1.0'?>
<!DOCTYPE service_bundle SYSTEM '/usr/share/lib/xml/dtd/service_bundle.dtd.1'>
<service_bundle type='manifest' name='export'>
<service name='network/spread' type='service' version='0'>
<create_default_instance enabled='true'/>
<single_instance/>
<dependency name='fs-local' grouping='require_all' restart_on='none' type='service'>
<service_fmri value='svc:/system/filesystem/local'/>
</dependency>
<dependency name='network-service' grouping='require_all' restart_on='none' type='service'>