Details
-
Bug
-
Status: Closed (View Workflow)
-
Blocker
-
Resolution: Fixed
-
10.6(EOL), 11.8, 13.0, 13.1, 13.2, 13.3
-
Can result in unexpected behaviour
-
Q3/2026 Server Development
Description
Originally reported at https://hackerone.com/reports/3908943
I run this script:
SET sql_mode=ORACLE; |
|
|
DELIMITER $$
|
CREATE PACKAGE pkg1 AS |
FUNCTION f RETURN VARCHAR2(64); |
END
|
$$
|
CREATE PACKAGE BODY pkg1 AS |
FUNCTION f RETURN VARCHAR2(64) AS |
BEGIN RETURN 'benign'; |
END; |
END$$ |
DELIMITER ;
|
|
|
CREATE OR REPLACE USER reader@localhost; |
GRANT EXECUTE ON PACKAGE test.pkg1 TO reader@localhost; |
GRANT EXECUTE ON PACKAGE BODY test.pkg1 TO reader@localhost; |
|
|
SELECT host,db,user,routine_name,routine_type,proc_priv FROM mysql.procs_priv ORDER BY routine_type; |
It returns the following output:
+-----------+------+--------+--------------+--------------+-----------+
|
| host | db | user | routine_name | routine_type | proc_priv |
|
+-----------+------+--------+--------------+--------------+-----------+
|
| localhost | test | reader | pkg1 | PACKAGE | Execute |
|
| localhost | test | reader | pkg1 | PACKAGE BODY | Execute |
|
+-----------+------+--------+--------------+--------------+-----------+
|
Looks ok so far.
Now I drop the package and re-run the query to mysql.procs_priv:
DROP PACKAGE pkg1;
|
SELECT host,db,user,routine_name,routine_type,proc_priv FROM mysql.procs_priv ORDER BY routine_type;
|
It returns the following output:
+-----------+------+--------+--------------+--------------+-----------+
|
| host | db | user | routine_name | routine_type | proc_priv |
|
+-----------+------+--------+--------------+--------------+-----------+
|
| localhost | test | reader | pkg1 | PACKAGE BODY | Execute |
|
+-----------+------+--------+--------------+--------------+-----------+
|
Notice, the grant for PACKAGE BODY is still there. This is an unexpected behaviour. It should be removed by the DROP PACKAGE.
Reported by heyoimjeb
Attachments
Issue Links
- relates to
-
-
- Stalled
-
