{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "PostgreSQL SQL interface (psql over TCP 127.0.0.1:5432) to a real postgres:17 server with postgresql_anonymizer; dynamic/static masking rules applied via SECURITY LABEL FOR anon and anon.anonymize_table()",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "docker",
    "postgres:17 (PostgreSQL 17.11)",
    "postgresql_anonymizer 3.2.0-dev (vulnerable commit d6989f535813 / fixed commit 6f102520a86b)",
    "rust + pgrx 0.19.1 build"
  ],
  "target_identity": {
    "repository_url": "https://gitlab.com/dalibo/postgresql_anonymizer.git",
    "commit_sha": "d6989f5358131159f00f60860d744df2c685918c",
    "target_digest": "1f575e0f5d3d64b7bf84c1e00402e7116cfd60428d3502a5fc090baba733d91b",
    "runtime_digest": "17ad4974a0fdb6b994841484c27bdaeda9435b9ca7d0b71b9174fb1751ece38f",
    "platform": "linux",
    "architecture": "x86_64"
  },
  "proof_artifacts": [
    "repro/proof/vuln_a1_session.txt",
    "repro/proof/vuln_a1_markers.txt",
    "repro/proof/vuln_a1_loader.txt",
    "repro/proof/vuln_a1_marker_operator.txt",
    "repro/proof/vuln_a1_uid_operator.txt",
    "repro/proof/vuln_a1_marker_domain.txt",
    "repro/proof/vuln_a1_uid_domain.txt",
    "repro/proof/vuln_a1_marker_view.txt",
    "repro/proof/vuln_a1_uid_view.txt",
    "repro/proof/vuln_a2_session.txt",
    "repro/proof/vuln_a2_markers.txt",
    "repro/proof/vuln_a2_loader.txt",
    "repro/proof/vuln_a2_marker_operator.txt",
    "repro/proof/vuln_a2_uid_operator.txt",
    "repro/proof/vuln_a2_marker_domain.txt",
    "repro/proof/vuln_a2_uid_domain.txt",
    "repro/proof/vuln_a2_marker_view.txt",
    "repro/proof/vuln_a2_uid_view.txt",
    "repro/proof/fixed_a1_session.txt",
    "repro/proof/fixed_a1_markers.txt",
    "repro/proof/fixed_a1_loader.txt",
    "repro/proof/fixed_a1_marker_operator.txt",
    "repro/proof/fixed_a1_marker_domain.txt",
    "repro/proof/fixed_a1_marker_view.txt",
    "repro/proof/fixed_a2_session.txt",
    "repro/proof/fixed_a2_markers.txt",
    "repro/proof/fixed_a2_loader.txt",
    "repro/proof/fixed_a2_marker_operator.txt",
    "repro/proof/fixed_a2_marker_domain.txt",
    "repro/proof/fixed_a2_marker_view.txt",
    "repro/proof/fixed_c1_session.txt",
    "repro/proof/fixed_c1_markers.txt",
    "repro/proof/fixed_c1_loader.txt",
    "repro/proof/fixed_c1_marker_operator.txt",
    "repro/proof/fixed_c1_marker_domain.txt",
    "repro/proof/fixed_c1_marker_view.txt",
    "repro/proof/fixed_c1_negative_control_observation.json"
  ],
  "artifact_sha256": {
    "repro/proof/vuln_a1_session.txt": "dcda3942765719a76cfb3ea063489dc98e63d8110448bf8d6a2ef86804cf3f73",
    "repro/proof/vuln_a1_markers.txt": "2f3ca38ac861ed49ce1ddcf6b2740a3607396e92b946e5c4196c7a2be9e2f0dc",
    "repro/proof/vuln_a1_loader.txt": "3332dec0b4ea464d1d916e4bbfb52861235af7aa7a91145c80ad86831b98c736",
    "repro/proof/vuln_a1_marker_operator.txt": "cdc8aa6a75c7116f38d34b146af43673e772685dfbe9bbe06aa6591f779daaf1",
    "repro/proof/vuln_a1_uid_operator.txt": "415153436f8b44da97db71247de9fce344fb7a309dd794c91a6b459d8e2f234d",
    "repro/proof/vuln_a1_marker_domain.txt": "15031569ced35ba600b38dcd3c5e492fa789b3e99296ec45be3ef3e0f7f3f04b",
    "repro/proof/vuln_a1_uid_domain.txt": "415153436f8b44da97db71247de9fce344fb7a309dd794c91a6b459d8e2f234d",
    "repro/proof/vuln_a1_marker_view.txt": "6dd0f9139611c1a1767d5ea46d276683cd07beb1e97a51d62119bc81e56ef5e8",
    "repro/proof/vuln_a1_uid_view.txt": "415153436f8b44da97db71247de9fce344fb7a309dd794c91a6b459d8e2f234d",
    "repro/proof/vuln_a2_session.txt": "d365489bf37a07e7253a11c5bfe57c9166815a57d25d109ea97babcd2514791f",
    "repro/proof/vuln_a2_markers.txt": "6898cbd67e7cf2adeaf26a7200119361680a41cc86371f0eb25dd1addd746a73",
    "repro/proof/vuln_a2_loader.txt": "2d7c1f9da7c2aaea30bce2966a3ac8784a8ec090156680ee4fdd11813f22bd75",
    "repro/proof/vuln_a2_marker_operator.txt": "cba1e7ddf2b7e391560cf9d5bf04de29c0af24cdf9156e862e01f5aaadf9a272",
    "repro/proof/vuln_a2_uid_operator.txt": "415153436f8b44da97db71247de9fce344fb7a309dd794c91a6b459d8e2f234d",
    "repro/proof/vuln_a2_marker_domain.txt": "bd42a320c5186086ea0191fa35cb638f6c3f093a9cae29b7598259f4fb5a9362",
    "repro/proof/vuln_a2_uid_domain.txt": "415153436f8b44da97db71247de9fce344fb7a309dd794c91a6b459d8e2f234d",
    "repro/proof/vuln_a2_marker_view.txt": "369d736ec7ae2312ca56ec216577a8809f6ba0c97f6fcd1f5465a3c47542f9e8",
    "repro/proof/vuln_a2_uid_view.txt": "415153436f8b44da97db71247de9fce344fb7a309dd794c91a6b459d8e2f234d",
    "repro/proof/fixed_a1_session.txt": "7d17985d009d08be56b4a39f9b38e2a154d1912db4e12863e9104c8be6b5c257",
    "repro/proof/fixed_a1_markers.txt": "21f7d23ffd5b9f023760d890415a12968fe725c0b246e6ce9aaa5d2e16cc4e8c",
    "repro/proof/fixed_a1_loader.txt": "5c8491e5bd39f4643afef6e8ff677b5372ecff523df3b57499f57ec9b4c6dfde",
    "repro/proof/fixed_a1_marker_operator.txt": "5d5fbe9d73c13bb8012f21fd73d3e9a901d8506ecc05ea45f96ba6e30db96f86",
    "repro/proof/fixed_a1_marker_domain.txt": "bc3df59ed0ce9782bd4cb79cfa3a97feccc811ce276531b09595e59d7de9faf2",
    "repro/proof/fixed_a1_marker_view.txt": "eb761e5c4a9c327f4a2ead0030d911f69e3a8040625911b742470a18c06e8cfc",
    "repro/proof/fixed_a2_session.txt": "9e9cc911c65707dc80cb1c47678836727e9405118f88068b3448f077a0732f2f",
    "repro/proof/fixed_a2_markers.txt": "e566e504d41cee2a0b3c27040fbe924af657c07e5c31046175cc33273d45858a",
    "repro/proof/fixed_a2_loader.txt": "94900f9616beb640d940f822b14ddd3b1722c826de7f74188bbbf895788c58bf",
    "repro/proof/fixed_a2_marker_operator.txt": "f8a47163b87e16a6983c7da72bfa19f69d6ea0d50404b3fcc47c92e09d01129a",
    "repro/proof/fixed_a2_marker_domain.txt": "fb6a022273b4d9261fc7f5b7a3c883b953792803e073d1d60243f577d7caa735",
    "repro/proof/fixed_a2_marker_view.txt": "277a4dadbf0755dfa84e6327cca67cce449b03f5c27b3635e245b12892477349",
    "repro/proof/fixed_c1_session.txt": "c42a31108c277e91abbd749f598965701a0f0b5f665e6ab50af5d94d9294a2c5",
    "repro/proof/fixed_c1_markers.txt": "22c69a00be409aeeb0938a80b60eef95028af1bbc78227dab928244a0be049e7",
    "repro/proof/fixed_c1_loader.txt": "7269ea4245100283fe6c112dbe425a12b07da09a373ba516eb418aa3f834bc19",
    "repro/proof/fixed_c1_marker_operator.txt": "3bfd2128bbf59aec737c25e68431f8eea01453a257f0271cd633222861d4400c",
    "repro/proof/fixed_c1_marker_domain.txt": "a06ea0d2e5c8377ef64fc4dd1682c3f410beed0e0859c6453b47923700f9026f",
    "repro/proof/fixed_c1_marker_view.txt": "2f7b364b644b4537aec48c39f766ce0b0c847b751e1b8ec57d37c0c8d820d75b",
    "repro/proof/fixed_c1_negative_control_observation.json": "ac3fb01aa6324d113ac273e94c123bf7f0b0e04af2afc4fe332d32f7ebd68440"
  },
  "notes": "vulnerable_ok=true fixed_ok=true; positive attempts ran commit d6989f5358131159f00f60860d744df2c685918c (parent of fix 6f10252), negative control ran commit 6f102520a86bd9a9075e751d7674afb93ba7db10; payload = crafted operator / domain cast / view subquery in masking rules evaluated during anon.anonymize_table() run by the extension superuser; markers written via COPY TO PROGRAM prove OS command execution in the superuser context; ALTER ROLE proves SQL superuser escalation"
}