Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BugFix] Fix show table status not check view privilege #53811

Merged
merged 1 commit into from
Dec 13, 2024
Merged

[BugFix] Fix show table status not check view privilege #53811

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions fe/fe-core/src/main/java/com/starrocks/qe/ShowExecutor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -576,7 +576,7 @@ public ShowResultSet visitShowTemporaryTablesStatement(ShowTemporaryTableStmt st
@Override
public ShowResultSet visitShowTableStatusStatement(ShowTableStatusStmt statement, ConnectContext context) {
List<List<String>> rows = Lists.newArrayList();
Database db = context.getGlobalStateMgr().getLocalMetastore().getDb(statement.getDb());
Database db = GlobalStateMgr.getCurrentState().getLocalMetastore().getDb(statement.getDb());
ZoneId currentTimeZoneId = TimeUtils.getTimeZone().toZoneId();
if (db != null) {
Locker locker = new Locker();
Expand All @@ -593,8 +593,8 @@ public ShowResultSet visitShowTableStatusStatement(ShowTableStatusStmt statement
}

try {
Authorizer.checkAnyActionOnTable(context.getCurrentUserIdentity(),
context.getCurrentRoleIds(), new TableName(db.getFullName(), table.getName()));
Authorizer.checkAnyActionOnTableLikeObject(context.getCurrentUserIdentity(),
context.getCurrentRoleIds(), db.getFullName(), table);
} catch (AccessDeniedException e) {
continue;
}
Expand Down Expand Up @@ -1853,10 +1853,10 @@ public ShowResultSet visitShowRestoreStatement(ShowRestoreStmt statement, Connec

// restore info for external catalog
AbstractJob jobI = GlobalStateMgr.getCurrentState().getBackupHandler().getJob(-1L);
if (jobI != null && jobI instanceof RestoreJob) {
if (jobI != null && jobI instanceof RestoreJob) {
RestoreJob restoreJob = (RestoreJob) jobI;
List<String> info = restoreJob.getInfo();
infos.add(info);
infos.add(info);
}

return new ShowResultSet(statement.getMetaData(), infos);
Expand Down
4 changes: 4 additions & 0 deletions fe/fe-core/src/main/java/com/starrocks/sql/analyzer/Authorizer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,6 +185,10 @@ public static void checkAnyActionOnTableLikeObject(UserIdentity currentUser, Set

private static void doCheckTableLikeObject(UserIdentity currentUser, Set<Long> roleIds, String dbName,
BasicTable tbl, PrivilegeType privilegeType) throws AccessDeniedException {
if (tbl == null) {
return;
}

Table.TableType type = tbl.getType();
switch (type) {
case OLAP:
Expand Down
12 changes: 8 additions & 4 deletions fe/fe-core/src/main/java/com/starrocks/sql/analyzer/AuthorizerStmtVisitor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
import com.starrocks.analysis.TableRef;
import com.starrocks.backup.AbstractJob;
import com.starrocks.backup.BackupJob;
import com.starrocks.catalog.BasicTable;
import com.starrocks.catalog.Database;
import com.starrocks.catalog.Function;
import com.starrocks.catalog.FunctionSearchDesc;
Expand Down Expand Up @@ -1631,7 +1632,7 @@ public Void visitCancelAlterTableStatement(CancelAlterTableStmt statement, Conne
Database db = GlobalStateMgr.getCurrentState().getLocalMetastore().getDb(statement.getDbName());
if (db != null) {
Table table = GlobalStateMgr.getCurrentState().getLocalMetastore()
.getTable(db.getFullName(), statement.getTableName());
.getTable(db.getFullName(), statement.getTableName());
if (table == null || !table.isMaterializedView()) {
// ignore privilege check for old mv
return null;
Expand Down Expand Up @@ -1682,7 +1683,10 @@ public Void visitDescTableStmt(DescribeStmt statement, ConnectContext context) {
@Override
public Void visitShowCreateTableStatement(ShowCreateTableStmt statement, ConnectContext context) {
try {
Authorizer.checkAnyActionOnTable(context.getCurrentUserIdentity(), context.getCurrentRoleIds(), statement.getTbl());
BasicTable basicTable = GlobalStateMgr.getCurrentState().getMetadataMgr().getBasicTable(
statement.getTbl().getCatalog(), statement.getTbl().getDb(), statement.getTbl().getTbl());
Authorizer.checkAnyActionOnTableLikeObject(context.getCurrentUserIdentity(), context.getCurrentRoleIds(),
statement.getDb(), basicTable);
} catch (AccessDeniedException e) {
AccessDeniedException.reportAccessDenied(
statement.getTbl().getCatalog(),
Expand Down Expand Up @@ -2154,7 +2158,7 @@ public Void visitBackupStatement(BackupStmt statement, ConnectContext context) {
externalCatalogs.forEach(externalCatalog -> {
try {
Authorizer.checkCatalogAction(context.getCurrentUserIdentity(), context.getCurrentRoleIds(),
externalCatalog.getCatalogName(), PrivilegeType.USAGE);
externalCatalog.getCatalogName(), PrivilegeType.USAGE);
} catch (AccessDeniedException e) {
AccessDeniedException.reportAccessDenied(
externalCatalog.getCatalogName(),
Expand Down Expand Up @@ -2280,7 +2284,7 @@ public Void visitRestoreStatement(RestoreStmt statement, ConnectContext context)
// check insert on specified table
for (TableRef tableRef : tableRefs) {
Table table = GlobalStateMgr.getCurrentState().getLocalMetastore()
.getTable(db.getFullName(), tableRef.getName().getTbl());
.getTable(db.getFullName(), tableRef.getName().getTbl());
if (table != null) {
try {
Authorizer.checkTableAction(context.getCurrentUserIdentity(), context.getCurrentRoleIds(),
Expand Down
1 change: 0 additions & 1 deletion fe/fe-core/src/main/java/com/starrocks/sql/analyzer/ShowStmtAnalyzer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,7 +139,6 @@ public Void visitShowTemporaryTablesStatement(ShowTemporaryTableStmt node, Conne
return visitShowTableStatement(node, context);
}


@Override
public Void visitShowTabletStatement(ShowTabletStmt node, ConnectContext context) {
ShowTabletStmtAnalyzer.analyze(node, context);
Expand Down
1 change: 1 addition & 0 deletions fe/starrocks_intellij_style.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
</option>
</JavaCodeStyleSettings>
<codeStyleSettings language="JAVA">
<option name="RIGHT_MARGIN" value="130" />
<option name="KEEP_FIRST_COLUMN_COMMENT" value="false" />
<option name="KEEP_CONTROL_STATEMENT_IN_ONE_LINE" value="false" />
<option name="KEEP_BLANK_LINES_IN_DECLARATIONS" value="1" />
Expand Down
32 changes: 32 additions & 0 deletions test/sql/test_rbac/R/test_view_privilege
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
-- name: test_view_privilege
drop user if exists u1;
-- result:
-- !result
create user u1;
-- result:
-- !result
grant impersonate on user root to u1;
-- result:
-- !result
CREATE TABLE tbl1 (col1 INT, col2 INT, col3 INT);
-- result:
-- !result
CREATE VIEW view1 AS SELECT * FROM tbl1;
-- result:
-- !result
execute as u1 with no revert;
-- result:
-- !result
SHOW TABLE STATUS;
-- result:
-- !result
show create view view1;
-- result:
E: (5203, 'Access denied; you need (at least one of) the ANY privilege(s) on TABLE view1 for this operation. Please ask the admin to grant permission(s) or try activating existing roles using <set [default] role>. Current role(s): NONE. Inactivated role(s): NONE.')
-- !result
execute as root with no revert;
-- result:
-- !result
drop user u1;
-- result:
-- !result
14 changes: 14 additions & 0 deletions test/sql/test_rbac/T/test_view_privilege
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
-- name: test_view_privilege
drop user if exists u1;
create user u1;
grant impersonate on user root to u1;

CREATE TABLE tbl1 (col1 INT, col2 INT, col3 INT);
CREATE VIEW view1 AS SELECT * FROM tbl1;

execute as u1 with no revert;
SHOW TABLE STATUS;
show create view view1;

execute as root with no revert;
drop user u1;
Loading