linrrzqqq opened a new pull request, #66746:
URL: https://github.com/apache/doris/pull/66746
Problem Summary:
Authenticated non-admin users could inspect sessions and active SQL
statements belonging to other users through `information_schema.processlist`,
`SHOW PROCESSLIST`, and `information_schema.active_queries`.
```sql
CREATE USER 'pl_victim' IDENTIFIED BY 'C123_567p';
CREATE USER 'pl_attacker' IDENTIFIED BY 'C123_567p';
GRANT SELECT_PRIV ON processlist_demo.* TO 'pl_victim';
GRANT SELECT_PRIV ON processlist_demo.* TO 'pl_attacker';
-- victim
SELECT SLEEP(120), 'victim_secret_token=demo-only-123';
-- attacker
SELECT User, Command, Info
FROM information_schema.processlist
WHERE User = 'pl_victim';
+-------------+---------+-------------------------------------------------------------------------------------------------------------------------+
| User | Command | Info
|
+-------------+---------+-------------------------------------------------------------------------------------------------------------------------+
| pl_attacker | Query | SELECT User, Command, Info
FROM information_schema.processlist
WHERE User IN ('pl_victim', 'pl_attacker')
ORDER BY User |
| pl_victim | Query | SELECT SLEEP(120),
'victim_secret_token=demo-only-123'
|
+-------------+---------+-------------------------------------------------------------------------------------------------------------------------+
-- attacker
SELECT USER, SQL
FROM information_schema.active_queries;
+-------------+---------------------------------------------------------+
| USER | SQL |
+-------------+---------------------------------------------------------+
| pl_victim | SELECT SLEEP(120), 'victim_secret_token=demo-only-123' |
| pl_attacker | SELECT USER, SQL
FROM information_schema.active_queries |
+-------------+---------------------------------------------------------+
```
The schema scanners did not consistently propagate the caller's user
identity to FE, and the FE metadata handlers did not always enforce per-user
visibility.
### Release note
Non-admin users can now see only their own sessions and active queries
through processlist and information_schema.active_queries. ADMIN users retain
cluster-wide visibility.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
