fix(postgres): deny set_config() in readonly mode (#448) (#464)

Readonly mode rejects `SET statement_timeout = 0`, but
`SELECT set_config('statement_timeout', '0', false)` passed the access
policy and made the same change. The setting is session-scoped, so it
stuck on the pooled connection and later calls ran without the
server-side deadline that query_timeout applies as statement_timeout.
search_path could be rewritten the same way.

Add set_config to the PostgreSQL escape-hatch list so it classifies as
admin, like the other SELECT-invocable functions a read-only transaction
does not contain. Matching is call-position only, so current_setting()
and columns named set_config are unaffected.

Co-authored-by: Claude Fable 5.1 <[email protected]>

Author: tianzhou

src/utils/__tests__/allowed-keywords.test.ts

@@ -311,6 +311,10 @@ describe("isReadOnlySQL", () => {
       ["postgres", "SELECT pg_read_file('/etc/passwd')"],
       ["postgres", "SELECT pg_read_binary_file('server.key')"],
       ["postgres", "SELECT pg_ls_dir('/var/lib/postgresql')"],
+      // set_config is SET in function form; the session-scoped variant undoes
+      // the statement_timeout / search_path applied at connect (issue #448).
+      ["postgres", "SELECT set_config('statement_timeout', '0', false)"],
+      ["postgres", "SELECT pg_catalog.set_config('search_path', 'pg_catalog,public', false)"],
       // SQL Server pass-through sources share the same call-position guard:
       // OPENQUERY's payload runs on the remote server, OPENROWSET(BULK) reads
       // server-side files, OPENDATASOURCE opens ad-hoc connections.
@@ -344,6 +348,11 @@ describe("isReadOnlySQL", () => {
       expect(isReadOnlySQL("SELECT load_file FROM documents", "mysql")).toBe(true);
       expect(isReadOnlySQL("SELECT count(*) AS get_lock FROM t", "mysql")).toBe(true);
       expect(isReadOnlySQL("SELECT pg_read_file FROM audit", "postgres")).toBe(true);
+      expect(isReadOnlySQL("SELECT set_config FROM audit", "postgres")).toBe(true);
+    });
+
+    it("still allows reading settings through current_setting (issue #448)", () => {
+      expect(isReadOnlySQL("SELECT current_setting('statement_timeout')", "postgres")).toBe(true);
     });
 
     it("does not apply another dialect's escape-hatch list", () => {

src/utils/__tests__/sql-access-policy.test.ts

@@ -48,6 +48,15 @@ describe("classifyStatement", () => {
     expect(classifyStatement("SELECT get_lock('x', 10)", "mariadb")).toBe("admin");
     expect(classifyStatement("SELECT pg_read_file('/etc/passwd')", "postgres")).toBe("admin");
   });
+
+  it("classifies set_config as admin so readonly denies it like SET (issue #448)", () => {
+    expect(classifyStatement("SELECT set_config('statement_timeout', '0', false)", "postgres")).toBe("admin");
+    expect(classifyStatement("SELECT current_setting('statement_timeout')", "postgres")).toBe("read");
+    const readonly = policyFromReadonly(true);
+    expect(sqlVerdict(readonly, "SET statement_timeout = 0", "postgres")).toBe("deny");
+    expect(sqlVerdict(readonly, "SELECT set_config('statement_timeout', '0', false)", "postgres")).toBe("deny");
+    expect(sqlVerdict(readonly, "SELECT current_setting('statement_timeout')", "postgres")).toBe("allow");
+  });
 });
 
 describe("classifySQL (multi-statement)", () => {

src/utils/allowed-keywords.ts

@@ -125,7 +125,11 @@ export const sqlServerPassThroughPattern = new RegExp(
  *   advisory locks (a session side effect).
  * - PostgreSQL: pg_read_file / pg_read_binary_file / pg_ls_dir read the
  *   server filesystem (pg_read_server_files role; default_transaction_read_only
- *   does not apply).
+ *   does not apply). set_config is SET in function form: it rewrites session
+ *   state such as the statement_timeout DBHub applies from query_timeout or
+ *   the configured search_path, and the change outlives the statement on the
+ *   pooled connection (issue #448). current_setting is read-only and stays
+ *   allowed.
  * - SQL Server: OPENQUERY / OPENROWSET / OPENDATASOURCE run on a
  *   remote/ad-hoc source outside the local read-only transaction
  *   (sqlServerPassThroughKeywords, reused here as the single source of truth).
@@ -148,7 +152,7 @@ export const sqlServerPassThroughPattern = new RegExp(
 export const escapeHatchFunctionKeywords: Partial<Record<ConnectorType, readonly string[]>> = {
   mysql: ["load_file", "get_lock", "release_lock", "release_all_locks"],
   mariadb: ["load_file", "get_lock", "release_lock", "release_all_locks"],
-  postgres: ["pg_read_file", "pg_read_binary_file", "pg_ls_dir"],
+  postgres: ["pg_read_file", "pg_read_binary_file", "pg_ls_dir", "set_config"],
   sqlserver: sqlServerPassThroughKeywords,
   // Oracle packages a SELECT can call to reach outside the database, matched
   // as `package.member(` (see escapeHatchCallSuffix).