Assuming I implement the literal SQL-injection on an HTTP endpoint with a read-only user that limits execution time to e.g. some amount of seconds. What's the worst that could happen? I know simple attacks could be just flooding simple queries. But is there another potential risk?
I already noticed some issues to mitigate:
publicrole needs to be completely revoked of all permission and never granted anything.
- Some functions might be more time and cpu intensive. I do wonder if there's a way to limit the exposure to these other than a simple time out.
- In general exposure to too many tables and columns.
Because this is a web service I control - I can constrain the contents of the SQL query, so that's something I'd love to hear if there are functions, keywords or characters that I need to strip to make sure people are only making reasonable
I realize this is somewhat of a vague request, but then again, security is a bit vague.