fix: revoke public trigger privilege on net tables

Makefile

@@ -26,7 +26,7 @@ else
 endif
 
 EXTENSION = pg_net
-EXTVERSION = 0.20.3
+EXTVERSION = 0.20.4
 
 DATA = $(wildcard sql/*--*.sql)
 

sql/pg_net--0.20.3--0.20.4.sql

@@ -0,0 +1 @@
+revoke trigger on all tables in schema net from PUBLIC;

sql/pg_net.sql

@@ -355,3 +355,7 @@ $$;
 grant usage on schema net to PUBLIC;
 grant all on all sequences in schema net to PUBLIC;
 grant all on all tables in schema net to PUBLIC;
+
+-- we do not want users to be able to create triggers on tables in the net schema to avoid
+-- privilege escalation bugs.
+revoke trigger on all tables in schema net from PUBLIC;

test/test_privileges.py

@@ -120,3 +120,57 @@ def test_net_on_new_role(sess):
         set local role postgres;
         drop role another;
     """))
+
+
+def test_public_roles_cannot_create_triggers_on_internal_tables(sess):
+    """Internal tables must not allow trigger-based privilege escalation."""
+
+    (can_select, can_trigger) = sess.execute(text("""
+        select
+            has_table_privilege('pre_existing', 'net._http_response', 'select'),
+            has_table_privilege('pre_existing', 'net._http_response', 'trigger');
+    """)).fetchone()
+
+    assert can_select is True
+    assert can_trigger is False
+
+    sess.execute(text("""
+        create table public.t1 (id text);
+
+        create or replace function public.my_trigger_fn()
+        returns trigger
+        language plpgsql
+        as $$
+        begin
+            insert into public.t1 (id) values (current_user);
+            return new;
+        end
+        $$;
+    """))
+    sess.commit()
+
+    with pytest.raises(Exception) as execinfo:
+        sess.execute(text("""
+            set local role to pre_existing;
+
+            create trigger my_trigger
+            after insert on net.http_request_queue
+            for each row
+            execute function public.my_trigger_fn();
+        """))
+
+    assert "permission denied for table http_request_queue" in str(execinfo.value)
+
+    sess.rollback()
+
+    with pytest.raises(Exception) as execinfo:
+        sess.execute(text("""
+            set local role to pre_existing;
+
+            create trigger my_trigger
+            after insert on net._http_response
+            for each row
+            execute function public.my_trigger_fn();
+        """))
+
+    assert "permission denied for table _http_response" in str(execinfo.value)