swornim619 opened a new pull request, #38845:
URL: https://github.com/apache/shardingsphere/pull/38845
## Summary
DistSQL statements were routed directly to execution in
`ProxyBackendHandlerFactory` without consulting the configured
`AuthorityRule` or evaluating the authenticated user's `admin` flag.
Any authenticated user — regardless of how restrictively they were
configured — could execute every administrative DistSQL operation,
including `SHOW STORAGE UNITS`, `REGISTER STORAGE UNIT`,
`EXPORT DATABASE CONFIGURATION`, and `UNREGISTER STORAGE UNIT`.
The `admin: false` flag, the `DATABASE_PERMITTED` privilege provider,
and `user-database-mappings` scope restrictions were all completely
inert for DistSQL statements.
This was reported to the Apache Security Team (May 2026). It was
determined to be out of scope for a CVE under the project's security
policy, and the team directed that it be submitted as a hardening
improvement instead.
## Changes
- `AuthorityChecker`: extracts `isAdmin()` as a named public method
so the logic is not duplicated
- `AuthorityDistSQLExecutionChecker`: new class in the authority module
that enforces a two-tier check for DistSQL statements
- `ProxyBackendHandlerFactory`: calls the new checker before dispatching
any DistSQL statement
- `AuthorityDistSQLExecutionCheckerTest`: 12 unit tests covering all
authorization paths
## Authorization model
Write DistSQL (RDL, updatable RAL) requires `admin: true`.
Read DistSQL (RQL, queryable RAL, RUL) requires `admin: true` or
`DATABASE_PERMITTED` access to the current database scope.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
