Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

planner: make some show stmt more fine-grained privilege check #35493

Merged
merged 9 commits into from
Jun 21, 2022
Merged

planner: make some show stmt more fine-grained privilege check #35493

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
cf99e5a
make some show stmt more fine-grained privilege check
likzn Jun 18, 2022
827dd82
unit update
likzn Jun 18, 2022
7a1b2bc
fix
likzn Jun 18, 2022
c035075
refactor code
likzn Jun 19, 2022
5c9495d
fix unit
likzn Jun 21, 2022
44baeea
Merge branch 'master' into fix_privige
ti-chi-bot Jun 21, 2022
a65f54f
Merge branch 'master' into fix_privige
hawkingrei Jun 21, 2022
c5fb384
Merge branch 'master' into fix_privige
ti-chi-bot Jun 21, 2022
2246fa3
Merge branch 'master' into fix_privige
likzn Jun 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 19 additions & 7 deletions executor/showtest/show_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -794,20 +794,32 @@ func TestShowStatsPrivilege(t *testing.T) {
tk1 := testkit.NewTestKit(t, store)

require.True(t, tk1.Session().Auth(&auth.UserIdentity{Username: "show_stats", Hostname: "%"}, nil, nil))
e := "[planner:1142]SHOW command denied to user 'show_stats'@'%' for table"
err := tk1.ExecToErr("show stats_meta")
require.ErrorContains(t, err, e)
err = tk1.ExecToErr("SHOW STATS_BUCKETS")
require.ErrorContains(t, err, e)
err = tk1.ExecToErr("SHOW STATS_HISTOGRAMS")
require.ErrorContains(t, err, e)

eqErr := plannercore.ErrDBaccessDenied.GenWithStackByArgs("show_stats", "%", mysql.SystemDB)
_, err := tk1.Exec("show stats_meta")
require.EqualError(t, err, eqErr.Error())
_, err = tk1.Exec("SHOW STATS_BUCKETS")
require.EqualError(t, err, eqErr.Error())
_, err = tk1.Exec("SHOW STATS_HEALTHY")
require.EqualError(t, err, eqErr.Error())
_, err = tk1.Exec("SHOW STATS_HISTOGRAMS")
err = tk1.ExecToErr("SHOW STATS_HEALTHY")
require.EqualError(t, err, eqErr.Error())
tk.MustExec("grant select on mysql.* to show_stats")
tk1.MustExec("show stats_meta")
tk1.MustExec("SHOW STATS_BUCKETS")
tk1.MustExec("SHOW STATS_HEALTHY")
tk1.MustExec("SHOW STATS_HISTOGRAMS")

tk.MustExec("create user a@'%' identified by '';")
require.True(t, tk1.Session().Auth(&auth.UserIdentity{Username: "a", Hostname: "%"}, nil, nil))
tk.MustExec("grant select on mysql.stats_meta to a@'%';")
tk.MustExec("grant select on mysql.stats_buckets to a@'%';")
tk.MustExec("grant select on mysql.stats_histograms to a@'%';")
tk1.MustExec("show stats_meta")
tk1.MustExec("SHOW STATS_BUCKETS")
tk1.MustExec("SHOW STATS_HISTOGRAMS")

}

func TestIssue18878(t *testing.T) {
Expand Down
6 changes: 3 additions & 3 deletions parser/parser.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18992,19 +18992,19 @@ yynewstate:
}
case 1895:
{
parser.yyVAL.item = &ast.ShowStmt{Tp: ast.ShowStatsMeta}
parser.yyVAL.item = &ast.ShowStmt{Tp: ast.ShowStatsMeta, Table: &ast.TableName{Name: model.NewCIStr("STATS_META"), Schema: model.NewCIStr(mysql.SystemDB)}}
}
case 1896:
{
parser.yyVAL.item = &ast.ShowStmt{Tp: ast.ShowStatsHistograms}
parser.yyVAL.item = &ast.ShowStmt{Tp: ast.ShowStatsHistograms, Table: &ast.TableName{Name: model.NewCIStr("STATS_HISTOGRAMS"), Schema: model.NewCIStr(mysql.SystemDB)}}
}
case 1897:
{
parser.yyVAL.item = &ast.ShowStmt{Tp: ast.ShowStatsTopN}
}
case 1898:
{
parser.yyVAL.item = &ast.ShowStmt{Tp: ast.ShowStatsBuckets}
parser.yyVAL.item = &ast.ShowStmt{Tp: ast.ShowStatsBuckets, Table: &ast.TableName{Name: model.NewCIStr("STATS_BUCKETS"), Schema: model.NewCIStr(mysql.SystemDB)}}
}
case 1899:
{
Expand Down
6 changes: 3 additions & 3 deletions parser/parser.y
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10810,19 +10810,19 @@ ShowTargetFilterable:
}
| "STATS_META"
{
$$ = &ast.ShowStmt{Tp: ast.ShowStatsMeta}
$$ = &ast.ShowStmt{Tp: ast.ShowStatsMeta, Table: &ast.TableName{Name: model.NewCIStr("STATS_META"), Schema: model.NewCIStr(mysql.SystemDB)}}
}
| "STATS_HISTOGRAMS"
{
$$ = &ast.ShowStmt{Tp: ast.ShowStatsHistograms}
$$ = &ast.ShowStmt{Tp: ast.ShowStatsHistograms, Table: &ast.TableName{Name: model.NewCIStr("STATS_HISTOGRAMS"), Schema: model.NewCIStr(mysql.SystemDB)}}
}
| "STATS_TOPN"
{
$$ = &ast.ShowStmt{Tp: ast.ShowStatsTopN}
}
| "STATS_BUCKETS"
{
$$ = &ast.ShowStmt{Tp: ast.ShowStatsBuckets}
$$ = &ast.ShowStmt{Tp: ast.ShowStatsBuckets, Table: &ast.TableName{Name: model.NewCIStr("STATS_BUCKETS"), Schema: model.NewCIStr(mysql.SystemDB)}}
}
| "STATS_HEALTHY"
{
Expand Down
11 changes: 8 additions & 3 deletions planner/core/planbuilder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2986,13 +2986,18 @@ func (b *PlanBuilder) buildShow(ctx context.Context, show *ast.ShowStmt) (Plan,
p.setSchemaAndNames(buildShowNextRowID())
b.visitInfo = appendVisitInfo(b.visitInfo, mysql.SelectPriv, show.Table.Schema.L, show.Table.Name.L, "", ErrPrivilegeCheckFail)
return p, nil
case ast.ShowStatsBuckets, ast.ShowStatsHistograms, ast.ShowStatsMeta, ast.ShowStatsExtended, ast.ShowStatsHealthy, ast.ShowStatsTopN, ast.ShowHistogramsInFlight, ast.ShowColumnStatsUsage:
user := b.ctx.GetSessionVars().User
case ast.ShowStatsExtended, ast.ShowStatsHealthy, ast.ShowStatsTopN, ast.ShowHistogramsInFlight, ast.ShowColumnStatsUsage:
var err error
if user != nil {
if user := b.ctx.GetSessionVars().User; user != nil {
err = ErrDBaccessDenied.GenWithStackByArgs(user.AuthUsername, user.AuthHostname, mysql.SystemDB)
}
b.visitInfo = appendVisitInfo(b.visitInfo, mysql.SelectPriv, mysql.SystemDB, "", "", err)
case ast.ShowStatsBuckets, ast.ShowStatsHistograms, ast.ShowStatsMeta:
var err error
if user := b.ctx.GetSessionVars().User; user != nil {
err = ErrTableaccessDenied.GenWithStackByArgs("SHOW", user.AuthUsername, user.AuthHostname, show.Table.Name.L)
}
b.visitInfo = appendVisitInfo(b.visitInfo, mysql.SelectPriv, show.Table.Schema.L, show.Table.Name.L, "", err)
case ast.ShowRegions:
tableInfo, err := b.is.TableByName(show.Table.Schema, show.Table.Name)
if err != nil {
Expand Down