149 lines
3.5 KiB
Python
149 lines
3.5 KiB
Python
"""
|
||
Supabase 安全知识
|
||
"""
|
||
|
||
from ..base import KnowledgeDocument, KnowledgeCategory
|
||
|
||
|
||
SUPABASE_SECURITY = KnowledgeDocument(
|
||
id="framework_supabase",
|
||
title="Supabase Security",
|
||
category=KnowledgeCategory.FRAMEWORK,
|
||
tags=["supabase", "postgresql", "rls", "auth", "baas"],
|
||
content="""
|
||
Supabase 是一个开源的Firebase替代品，安全性主要依赖于Row Level Security (RLS)。
|
||
|
||
## 核心安全机制
|
||
1. Row Level Security (RLS)
|
||
2. JWT认证
|
||
3. PostgreSQL权限系统
|
||
|
||
## 常见漏洞模式
|
||
|
||
### RLS未启用
|
||
```sql
|
||
-- 危险 - 表没有启用RLS
|
||
CREATE TABLE posts (
|
||
id SERIAL PRIMARY KEY,
|
||
user_id UUID,
|
||
content TEXT
|
||
);
|
||
-- 任何人都可以访问所有数据！
|
||
|
||
-- 安全 - 启用RLS
|
||
ALTER TABLE posts ENABLE ROW LEVEL SECURITY;
|
||
|
||
CREATE POLICY "Users can only see their own posts"
|
||
ON posts FOR SELECT
|
||
USING (auth.uid() = user_id);
|
||
```
|
||
|
||
### RLS策略不完整
|
||
```sql
|
||
-- 危险 - 只有SELECT策略
|
||
CREATE POLICY "select_policy" ON posts FOR SELECT
|
||
USING (auth.uid() = user_id);
|
||
-- INSERT/UPDATE/DELETE没有策略，可能被绕过
|
||
|
||
-- 安全 - 完整的CRUD策略
|
||
CREATE POLICY "insert_policy" ON posts FOR INSERT
|
||
WITH CHECK (auth.uid() = user_id);
|
||
|
||
CREATE POLICY "update_policy" ON posts FOR UPDATE
|
||
USING (auth.uid() = user_id);
|
||
|
||
CREATE POLICY "delete_policy" ON posts FOR DELETE
|
||
USING (auth.uid() = user_id);
|
||
```
|
||
|
||
### 服务端密钥泄露
|
||
```javascript
|
||
// 危险 - 在前端使用service_role密钥
|
||
const supabase = createClient(url, 'service_role_key');
|
||
// service_role绕过RLS！
|
||
|
||
// 安全 - 前端只使用anon key
|
||
const supabase = createClient(url, 'anon_key');
|
||
```
|
||
|
||
### 不安全的函数
|
||
```sql
|
||
-- 危险 - SECURITY DEFINER函数
|
||
CREATE FUNCTION get_all_users()
|
||
RETURNS SETOF users
|
||
LANGUAGE sql
|
||
SECURITY DEFINER -- 以函数所有者权限执行
|
||
AS $$
|
||
SELECT * FROM users;
|
||
$$;
|
||
|
||
-- 安全 - 使用SECURITY INVOKER或添加检查
|
||
CREATE FUNCTION get_user_data(target_user_id UUID)
|
||
RETURNS SETOF users
|
||
LANGUAGE sql
|
||
SECURITY INVOKER
|
||
AS $$
|
||
SELECT * FROM users WHERE id = target_user_id;
|
||
$$;
|
||
```
|
||
|
||
### 存储桶权限
|
||
```sql
|
||
-- 危险 - 公开存储桶
|
||
INSERT INTO storage.buckets (id, name, public)
|
||
VALUES ('uploads', 'uploads', true);
|
||
-- 任何人都可以访问所有文件
|
||
|
||
-- 安全 - 私有存储桶 + RLS
|
||
INSERT INTO storage.buckets (id, name, public)
|
||
VALUES ('uploads', 'uploads', false);
|
||
|
||
CREATE POLICY "Users can access own files"
|
||
ON storage.objects FOR SELECT
|
||
USING (auth.uid()::text = (storage.foldername(name))[1]);
|
||
```
|
||
|
||
### JWT验证绕过
|
||
```javascript
|
||
// 危险 - 不验证JWT
|
||
const { data } = await supabase
|
||
.from('posts')
|
||
.select('*')
|
||
.eq('user_id', userIdFromRequest); // 用户可以伪造
|
||
|
||
// 安全 - 使用auth.uid()
|
||
// RLS策略中使用auth.uid()自动从JWT获取用户ID
|
||
```
|
||
|
||
### Edge Functions安全
|
||
```typescript
|
||
// 危险 - 不验证请求来源
|
||
Deno.serve(async (req) => {
|
||
const { userId } = await req.json();
|
||
// 直接使用用户提供的userId
|
||
});
|
||
|
||
// 安全 - 从JWT获取用户
|
||
import { createClient } from '@supabase/supabase-js';
|
||
|
||
Deno.serve(async (req) => {
|
||
const authHeader = req.headers.get('Authorization');
|
||
const supabase = createClient(url, anonKey, {
|
||
global: { headers: { Authorization: authHeader } }
|
||
});
|
||
const { data: { user } } = await supabase.auth.getUser();
|
||
// 使用验证过的user.id
|
||
});
|
||
```
|
||
|
||
## 安全检查清单
|
||
1. 所有表都启用了RLS
|
||
2. 每个表都有完整的CRUD策略
|
||
3. 前端只使用anon key
|
||
4. service_role key只在服务端使用
|
||
5. 存储桶有适当的访问策略
|
||
6. 函数使用SECURITY INVOKER
|
||
7. Edge Functions验证JWT
|
||
""",
|
||
)
|