[
https://issues.apache.org/jira/browse/DERBY-4191?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12785501#action_12785501
]
Rick Hillegas commented on DERBY-4191:
--------------------------------------
Thanks for the patch, Mamta. I think that this would be good, incremental
improvement. My chief misgiving about this patch is that it attempts to
enumerate the cases which could go wrong. I don't think that I am smart enough
to list the problem cases even with the limited grammar that we have now. As we
extend the language, more problem cases may creep in. Here for instance is a
query which should fail but which still succeeds with this patch:
select myTable.a from myTable, admin.privateTable; -- here
admin.privateTable is a table that I don't have any SELECT privileges on
I continue to think that it would be best to always add the MIN_SELECT_PRIV and
then weed it out later if you can prove that it isn't needed. I think the
downside of this alternative approach is that some cases may slip through where
we needlessly look for column permissions. On the whole, I think that is a
better problem to have than ignoring permissions checks when they are required.
Another small comment: The code which adds the MIN_SELECT_PRIV seems to be
duplicated in a couple files. I would recommend abstracting this code into a
shared subroutine.
Thanks!
> Lack of SELECT privilege does not prevent SELECT COUNT(*)
> ---------------------------------------------------------
>
> Key: DERBY-4191
> URL: https://issues.apache.org/jira/browse/DERBY-4191
> Project: Derby
> Issue Type: Bug
> Components: SQL
> Affects Versions: 10.4.2.0, 10.5.1.1
> Reporter: Knut Anders Hatlen
> Assignee: Mamta A. Satoor
> Attachments:
> DERBY4191_ColumnLevelCheckInStatmentTablePerm_diff_patch1.txt,
> DERBY4191_countStar_privilege_diff_patch1.txt, repro.sql
>
>
> A user that does not have SELECT privilege on a table can still perform a
> SELECT COUNT(*) on that table. Counting a specific column (e.g., SELECT
> COUNT(X)) is prevented.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
