Suppose we have an SQL database. Suppose we have a user D who has no read access to some table named EMP (employees).
Suppose we allow him to create a table with a foreign key regarding EMP table. Is the danger here that when inserting into his table, by having failed/succeeded to insert D can infer what keys are absent/present in EMP ?
Also, say we allow D to read from EMP and he can also define a foreign key in his new table regarding EMP. Is the danger still the same only that others who can read D's table can try inserting and inferring ? Because basically D can copy EMP to his table because he can read EMP. So why does the foreign key matter if D can read EMP and is able to copy it anyway ?
How does the foreign key add to the security problem if having read access on EMP means you know all of EMP's entries ?