CalvinKirs commented on PR #68857: URL: https://github.com/apache/doris/pull/68857#issuecomment-6094793184
### Local code review: REQUEST_CHANGES Reviewed commit: `7acb53395182ac4c29564bafecf37c940bf8bcd6` Findings: **0 Blocker, 1 Major** **Major — External-table locks leave cascade authorization incomplete** [DropConstraintCommand.java:91–101](https://github.com/apache/doris/blob/7acb53395182ac4c29564bafecf37c940bf8bcd6/fe/fe-core/src/main/java/org/apache/doris/nereids/trees/plans/commands/DropConstraintCommand.java#L91-L101) ExternalTable inherits the no-op TableIf read/write locks. After DROP PRIMARY KEY passes the cascade authorization recheck, another session can complete ADD FOREIGN KEY on a new child. The drop then recomputes its cascade and deletes that child's FK without checking the dropping user's ALTER privilege on the child. Internal-table locks prevent this sequence; external-table locks do not. Please serialize FK ADD and PK DROP with a shared lock covering final authorization revalidation through cascade mutation, and add a deterministic external-parent concurrency test. The underlying external locking gap predates this PR, but the new authorization guarantee remains incomplete on that supported path. Verified by independent local review; no cluster test was run during review. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
