github-actions[bot] commented on code in PR #68088:
URL: https://github.com/apache/doris/pull/68088#discussion_r4032814225
##########
fe/fe-core/src/main/java/org/apache/doris/tablefunction/TableBinlogFunction.java:
##########
@@ -126,6 +129,16 @@ public TableBinlogFunction(Map<String, String> params)
throws AnalysisException
}
}
+ @Override
Review Comment:
**[P2] Authorize before exposing binlog metadata**
This override is only called by the rewrite-time `CheckPrivileges` visitor,
after analysis has already constructed `TableBinlogFunction`, resolved the
target, checked `needRowBinlog()`, and derived its schema. Consequently an
unauthorized normal query gets target-specific missing/type/binlog-state or
column-binding results before denial. More directly, `DESC FUNCTION
binlog(...)`, `EXPLAIN ... ANALYZED PLAN`, and binary `COM_STMT_PREPARE` all
return target-derived schema without ever entering rewrite (prepare explicitly
uses `ANALYZED_PLAN`). Please put the name-level authorization before
target-specific lookup/output binding and make every metadata consumer use it;
add negative coverage for normal pre-resolution errors, DESCRIBE, analyzed
EXPLAIN, and prepare.
##########
fe/fe-core/src/main/java/org/apache/doris/tablefunction/TableBinlogFunction.java:
##########
@@ -126,6 +129,16 @@ public TableBinlogFunction(Map<String, String> params)
throws AnalysisException
}
}
+ @Override
+ public void checkAuth(ConnectContext ctx) {
Review Comment:
**[P1] Preserve row filters and data masks on binlog reads**
This boolean grant check is not equivalent to ordinary table authorization.
For a table with `GRANT SELECT ... TO u` plus a restrictive row policy such as
`k = 1`, the base-table plan receives a policy filter, but this path remains
`LogicalTVFRelation -> PhysicalTVFRelation -> RowBinlogTableWrapper`: TVFs are
not wrapped by `LogicalCheckPolicy`, and its policy lookup only handles catalog
relations/views. The check therefore passes while `u` can read raw `k != 1`
history; plugin data masks are likewise never evaluated. Please apply the
origin table's row/mask policies to this TVF (including defined before-image
semantics), or fail closed/use a privilege explicitly exempt from those
policies, and add a policy-restricted regression.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
