Superuser escalation via untrusted nested masking functions

Privilege escalation in DALIBO PostgreSQL Anonymizer before 1.3.0 allows remote authenticated users who own tables to become superusers. The masking-rule validator checks only the outer function's schema, so nested calls to attacker-controlled functions in untrusted schemas remain accepted and later execute with the applying user's privileges. Exploitation requires table ownership and a privileged user to invoke static masking or an anonymous dump; masked users without table ownership cannot trigger it.