wenzhenghu commented on PR #65126:
URL: https://github.com/apache/doris/pull/65126#issuecomment-5071479985
Heads-up on a pre-existing bug I noticed while reviewing this PR's diff in
`MetaInfoAction.getAllDatabases()`.
This method computes a privilege-filtered list `dbNameSet` (via
`checkDbPriv(..., SHOW)`) but never uses it — it sorts and returns the
**unfiltered** `dbNames`. So any authenticated non-admin user (with the default
`enable_all_http_auth=false`) hitting `/api/meta/{ns}/databases` can enumerate
all database names, bypassing `SHOW` privilege.
To be clear: **this is NOT introduced by PR #65126.** The only change this
PR made to the file was:
```java
- List<String> dbNames = catalog.getDbNames();
+ List<String> dbNames = new ArrayList<>(catalog.getDbNames());
```
(L108), needed because `getDbNames()` now returns an immutable list and the
old code would throw `UnsupportedOperationException` on `Collections.sort`. The
filtering bug exists on the master baseline (and upstream) independently.
The v2 endpoint `MetaInfoActionV2.getAllDatabases()` already does this
correctly (returns `filteredDbNames`). I've filed a separate issue to track the
v1 fix so it stays out of this refactor's scope:
https://github.com/apache/doris/issues/66024
No change needed in this PR; flagging for visibility.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
