fix(0002): constrain pg_depend classid/refclassid to avoid cross-catalog oid collisions

lints/0002_auth_users_exposed.sql

@@ -27,16 +27,18 @@ from
         and auth_users_pg_class.relname = 'users'
         and auth_users_pg_namespace.nspname = 'auth'
     -- Depends on auth.users
+    -- objid/refobjid are only unique within a (class, refclass), so both must
+    -- be constrained or a numerically equal oid from another catalog matches
     join pg_catalog.pg_depend d
         on d.refobjid = auth_users_pg_class.oid
+        and d.refclassid = 'pg_catalog.pg_class'::regclass
+        and d.classid = 'pg_catalog.pg_rewrite'::regclass
     join pg_catalog.pg_rewrite r
         on r.oid = d.objid
     join pg_catalog.pg_class c
         on c.oid = r.ev_class
     join pg_catalog.pg_namespace n
         on n.oid = c.relnamespace
-    join pg_catalog.pg_class pg_class_auth_users
-        on d.refobjid = pg_class_auth_users.oid
 where
     d.deptype = 'n'
     and (
@@ -80,7 +82,7 @@ where
                     'security_invoker=on'
                 ]
             )
-            and not pg_class_auth_users.relrowsecurity
+            and not auth_users_pg_class.relrowsecurity
         )
     )
 group by

splinter.sql

@@ -127,16 +127,18 @@ from
         and auth_users_pg_class.relname = 'users'
         and auth_users_pg_namespace.nspname = 'auth'
     -- Depends on auth.users
+    -- objid/refobjid are only unique within a (class, refclass), so both must
+    -- be constrained or a numerically equal oid from another catalog matches
     join pg_catalog.pg_depend d
         on d.refobjid = auth_users_pg_class.oid
+        and d.refclassid = 'pg_catalog.pg_class'::regclass
+        and d.classid = 'pg_catalog.pg_rewrite'::regclass
     join pg_catalog.pg_rewrite r
         on r.oid = d.objid
     join pg_catalog.pg_class c
         on c.oid = r.ev_class
     join pg_catalog.pg_namespace n
         on n.oid = c.relnamespace
-    join pg_catalog.pg_class pg_class_auth_users
-        on d.refobjid = pg_class_auth_users.oid
 where
     d.deptype = 'n'
     and (
@@ -180,7 +182,7 @@ where
                     'security_invoker=on'
                 ]
             )
-            and not pg_class_auth_users.relrowsecurity
+            and not auth_users_pg_class.relrowsecurity
         )
     )
 group by

test/expected/0002_auth_users_exposed.out

@@ -44,6 +44,32 @@ begin;
     select * from lint."0002_auth_users_exposed";
  name | title | level | facing | categories | description | detail | remediation | metadata | cache_key 
 ------+-------+-------+--------+------------+-------------+--------+-------------+----------+-----------
+(0 rows)
+
+    rollback to savepoint a;
+    -- Not a failure mode: a view depending on an object from another catalog
+    -- whose oid numerically collides with auth.users' pg_class oid.
+    -- pg_depend.refobjid is only unique within a refclassid, so without a
+    -- refclassid filter such a view is reported even though it never
+    -- references auth.users.
+    create table public.orders (id int primary key);
+    create function public.order_count() returns bigint language sql as
+        $$select pg_catalog.count(*) from public.orders$$;
+    -- move the function's pg_proc oid onto auth.users' pg_class oid
+    update pg_catalog.pg_proc
+        set oid = (
+            select c.oid
+            from pg_catalog.pg_class c
+            join pg_catalog.pg_namespace n
+                on n.oid = c.relnamespace
+            where n.nspname = 'auth' and c.relname = 'users'
+        )
+        where oid = 'public.order_count'::pg_catalog.regproc;
+    create view public.order_stats as select public.order_count() as total;
+    -- 0 entries
+    select * from lint."0002_auth_users_exposed";
+ name | title | level | facing | categories | description | detail | remediation | metadata | cache_key 
+------+-------+-------+--------+------------+-------------+--------+-------------+----------+-----------
 (0 rows)
 
 rollback;

test/sql/0002_auth_users_exposed.sql

@@ -37,4 +37,30 @@ begin;
     select * from lint."0002_auth_users_exposed";
 
 
+    rollback to savepoint a;
+
+
+    -- Not a failure mode: a view depending on an object from another catalog
+    -- whose oid numerically collides with auth.users' pg_class oid.
+    -- pg_depend.refobjid is only unique within a refclassid, so without a
+    -- refclassid filter such a view is reported even though it never
+    -- references auth.users.
+    create table public.orders (id int primary key);
+    create function public.order_count() returns bigint language sql as
+        $$select pg_catalog.count(*) from public.orders$$;
+    -- move the function's pg_proc oid onto auth.users' pg_class oid
+    update pg_catalog.pg_proc
+        set oid = (
+            select c.oid
+            from pg_catalog.pg_class c
+            join pg_catalog.pg_namespace n
+                on n.oid = c.relnamespace
+            where n.nspname = 'auth' and c.relname = 'users'
+        )
+        where oid = 'public.order_count'::pg_catalog.regproc;
+    create view public.order_stats as select public.order_count() as total;
+    -- 0 entries
+    select * from lint."0002_auth_users_exposed";
+
+
 rollback;