Re: BUG #17549: wrong index scan plan with RLS

PG Bug reporting form <noreply(at)postgresql(dot)org> writes:
> # for RLS user, index scan can only use column a, and filter by lower(b)
> set app.a=1;
> explain analyse select * from abc where a=1 and lower(b)='1234';
> Index Scan using abc_a_lower_idx on abc
> Index Cond: (a = 1)
> Filter: (lower(b) = '1234'::text)

AFAICS this is operating as designed. It's unsafe to apply the
non-leakproof condition until we've verified that the row has a = 1.

In the particular case shown here, it might be all right to do it,
but cases such as bitmap indexscans or lossy index opclasses could
result in live re-evaluations of the indexqual conditions at some
rows. So we can't safely allow lower(b) to become part of the
indexquals.

regards, tom lane