Type:
Bug
Priority:
Blocker
Resolution:
Unresolved
Affects Version/s:
10.5 , 10.6 , 10.11 , 11.4 , 11.8
Courtesy of wlad
create database db;
create user u;
grant create , insert , select on db.t to u;
create sequence db.s;
select * from db.s;
--connect(con1,localhost,u,,db)
--error ER_TABLEACCESS_DENIED_ERROR
select nextval(s);
--error ER_TABLEACCESS_DENIED_ERROR
show create sequence s;
create table t (a int not null default (nextval(s)));
insert into t values (),();
select * from t;
select default (a) from t;
--disconnect con1
--connection default
select * from db.s;
drop database db;
drop user u;
10.5 85ecb80fa3192035b3beff9578dc254a857175dc
connect con1,localhost,u,,db;
select nextval(s);
ERROR 42000: INSERT command denied to user 'u' @ 'localhost' for table `db`.`s`
show create sequence s;
ERROR 42000: SHOW command denied to user 'u' @ 'localhost' for table `db`.`s`
create table t (a int not null default (nextval(s)));
insert into t values (),();
select * from t;
a
1
2
select default (a) from t;
default (a)
3
4
disconnect con1;
So, the user u does not have any access to the sequence db.s , cannot read from it or see its structure.
However, the user can refer to it in CREATE TABLE, and can read/insert a default value in such a table, thus both reading and modifying the sequence.
It has been discussed that the privileges should be checked at some point. It can be done
1) upon table creation/altering, or
2) upon insert/select.
Either way is likely to break something for existing users. Probably the first way, checking privileges upon creation, will break less, at least because this is a less frequent operation than INSERT/SELECT, but it's hard to predict for sure.
Another argument for the first approach is that the existence of the sequence is already checked upon CREATE, one can't create a table referring a sequence in DEFAULT if the sequence doesn't exist or if the referred object is not a sequence, which also means that in the variation of the test case above the unprivileged user gets information about db.s which they shouldn't normally have:
create user u;
grant create , insert , select on db.t to u;
create table db.s (x int );
connect con1,localhost,u,,db;
create table t (a int not null default (nextval(s)));
ERROR 42S02: 'db.s' is not a SEQUENCE
create table t (a int not null default (nextval(s2)));
ERROR 42S02: Table 'db.s2' doesn't exist
{"report":{"fcp":2981.4000000953674,"ttfb":1266.0999999046326,"pageVisibility":"visible","entityId":133528,"key":"jira.project.issue.view-issue","isInitial":true,"threshold":1000,"elementTimings":{},"userDeviceMemory":8,"userDeviceProcessors":64,"apdex":0.5,"journeyId":"b6972411-048f-4e03-9adc-e7ee87e95a41","navigationType":0,"readyForUser":3117.5,"redirectCount":0,"resourceLoadedEnd":3800.5999999046326,"resourceLoadedStart":1273.9000000953674,"resourceTiming":[{"duration":1151.8999998569489,"initiatorType":"link","name":"https://jira.mariadb.org/s/2c21342762a6a02add1c328bed317ffd-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/css/_super/batch.css","startTime":1273.9000000953674,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1273.9000000953674,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":2425.7999999523163,"responseStart":0,"secureConnectionStart":0},{"duration":1152.0999999046326,"initiatorType":"link","name":"https://jira.mariadb.org/s/7ebd35e77e471bc30ff0eba799ebc151-CDN/lu2cib/820016/12ta74/494e4c556ecbb29f90a3d3b4f09cb99c/_/download/contextbatch/css/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true&whisper-enabled=true","startTime":1274.2000000476837,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1274.2000000476837,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":2426.2999999523163,"responseStart":0,"secureConnectionStart":0},{"duration":1207.7000000476837,"initiatorType":"script","name":"https://jira.mariadb.org/s/0917945aaa57108d00c5076fea35e069-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/js/_super/batch.js?locale=en","startTime":1274.2999999523163,"connectEnd":1274.2999999523163,"connectStart":1274.2999999523163,"domainLookupEnd":1274.2999999523163,"domainLookupStart":1274.2999999523163,"fetchStart":1274.2999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":1274.2999999523163,"responseEnd":2482,"responseStart":2482,"secureConnectionStart":1274.2999999523163},{"duration":1318.9000000953674,"initiatorType":"script","name":"https://jira.mariadb.org/s/2d8175ec2fa4c816e8023260bd8c1786-CDN/lu2cib/820016/12ta74/494e4c556ecbb29f90a3d3b4f09cb99c/_/download/contextbatch/js/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true&whisper-enabled=true","startTime":1274.5999999046326,"connectEnd":1274.5999999046326,"connectStart":1274.5999999046326,"domainLookupEnd":1274.5999999046326,"domainLookupStart":1274.5999999046326,"fetchStart":1274.5999999046326,"redirectEnd":0,"redirectStart":0,"requestStart":1274.5999999046326,"responseEnd":2593.5,"responseStart":2593.5,"secureConnectionStart":1274.5999999046326},{"duration":1323.1000001430511,"initiatorType":"script","name":"https://jira.mariadb.org/s/a9324d6758d385eb45c462685ad88f1d-CDN/lu2cib/820016/12ta74/c92c0caa9a024ae85b0ebdbed7fb4bd7/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en","startTime":1274.7999999523163,"connectEnd":1274.7999999523163,"connectStart":1274.7999999523163,"domainLookupEnd":1274.7999999523163,"domainLookupStart":1274.7999999523163,"fetchStart":1274.7999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":1274.7999999523163,"responseEnd":2597.9000000953674,"responseStart":2597.9000000953674,"secureConnectionStart":1274.7999999523163},{"duration":1323.9000000953674,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":1275,"connectEnd":1275,"connectStart":1275,"domainLookupEnd":1275,"domainLookupStart":1275,"fetchStart":1275,"redirectEnd":0,"redirectStart":0,"requestStart":1275,"responseEnd":2598.9000000953674,"responseStart":2598.9000000953674,"secureConnectionStart":1275},{"duration":1324.5999999046326,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":1275.2000000476837,"connectEnd":1275.2000000476837,"connectStart":1275.2000000476837,"domainLookupEnd":1275.2000000476837,"domainLookupStart":1275.2000000476837,"fetchStart":1275.2000000476837,"redirectEnd":0,"redirectStart":0,"requestStart":1275.2000000476837,"responseEnd":2599.7999999523163,"responseStart":2599.7999999523163,"secureConnectionStart":1275.2000000476837},{"duration":1354.5,"initiatorType":"link","name":"https://jira.mariadb.org/s/b04b06a02d1959df322d9cded3aeecc1-CDN/lu2cib/820016/12ta74/a2ff6aa845ffc9a1d22fe23d9ee791fc/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":1275.2999999523163,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1275.2999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":2629.7999999523163,"responseStart":0,"secureConnectionStart":0},{"duration":1326.2999999523163,"initiatorType":"script","name":"https://jira.mariadb.org/rest/api/1.0/shortcuts/820016/47140b6e0a9bc2e4913da06536125810/shortcuts.js?context=issuenavigation&context=issueaction","startTime":1275.5,"connectEnd":1275.5,"connectStart":1275.5,"domainLookupEnd":1275.5,"domainLookupStart":1275.5,"fetchStart":1275.5,"redirectEnd":0,"redirectStart":0,"requestStart":1275.5,"responseEnd":2601.7999999523163,"responseStart":2601.7999999523163,"secureConnectionStart":1275.5},{"duration":1354.4000000953674,"initiatorType":"link","name":"https://jira.mariadb.org/s/3ac36323ba5e4eb0af2aa7ac7211b4bb-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.css?jira.create.linked.issue=true","startTime":1275.5999999046326,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1275.5999999046326,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":2630,"responseStart":0,"secureConnectionStart":0},{"duration":1327.7999999523163,"initiatorType":"script","name":"https://jira.mariadb.org/s/5d5e8fe91fbc506585e83ea3b62ccc4b-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.js?jira.create.linked.issue=true&locale=en","startTime":1275.7999999523163,"connectEnd":1275.7999999523163,"connectStart":1275.7999999523163,"domainLookupEnd":1275.7999999523163,"domainLookupStart":1275.7999999523163,"fetchStart":1275.7999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":1275.7999999523163,"responseEnd":2603.5999999046326,"responseStart":2603.5999999046326,"secureConnectionStart":1275.7999999523163},{"duration":2116.2999999523163,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":1276.7999999523163,"connectEnd":1276.7999999523163,"connectStart":1276.7999999523163,"domainLookupEnd":1276.7999999523163,"domainLookupStart":1276.7999999523163,"fetchStart":1276.7999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":1276.7999999523163,"responseEnd":3393.0999999046326,"responseStart":3393.0999999046326,"secureConnectionStart":1276.7999999523163},{"duration":2523.7999999523163,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":1276.7999999523163,"connectEnd":1276.7999999523163,"connectStart":1276.7999999523163,"domainLookupEnd":1276.7999999523163,"domainLookupStart":1276.7999999523163,"fetchStart":1276.7999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":1276.7999999523163,"responseEnd":3800.5999999046326,"responseStart":3800.5999999046326,"secureConnectionStart":1276.7999999523163},{"duration":739,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":2656.2999999523163,"connectEnd":2656.2999999523163,"connectStart":2656.2999999523163,"domainLookupEnd":2656.2999999523163,"domainLookupStart":2656.2999999523163,"fetchStart":2656.2999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":2656.2999999523163,"responseEnd":3395.2999999523163,"responseStart":3395.2000000476837,"secureConnectionStart":2656.2999999523163},{"duration":902.2000000476837,"initiatorType":"script","name":"https://www.google-analytics.com/analytics.js","startTime":2967.2999999523163,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":2967.2999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":3869.5,"responseStart":0,"secureConnectionStart":0}],"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":1086,"responseStart":1266,"responseEnd":1268,"domLoading":1271,"domInteractive":3824,"domContentLoadedEventStart":3824,"domContentLoadedEventEnd":3869,"domComplete":5931,"loadEventStart":5931,"loadEventEnd":5933,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[{"name":"bigPipe.sidebar-id.start","time":3806.2999999523163},{"name":"bigPipe.sidebar-id.end","time":3807.2999999523163},{"name":"bigPipe.activity-panel-pipe-id.start","time":3807.4000000953674},{"name":"bigPipe.activity-panel-pipe-id.end","time":3810.0999999046326},{"name":"activityTabFullyLoaded","time":3878.2000000476837}],"measures":[],"correlationId":"af1181196d289c","effectiveType":"4g","downlink":9.4,"rtt":0,"serverDuration":111,"dbReadsTimeInMs":13,"dbConnsTimeInMs":22,"applicationHash":"9d11dbea5f4be3d4cc21f03a88dd11d8c8687422","experiments":[]}}